The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

358

Chapter 11 

■

Attacking Application Logic

70779c11.qxd:WileyRed  9/14/07  3:14 PM  Page 358

---

Chapter 11 

■

Attacking Application Logic  359

HACK STEPS

■

In a complex application involving either horizontal or vertical privilege

segregation, try to locate any instances where an individual user can

accumulate an amount of state within their session which relates in

some way to their identity.

■

Try to step through one area of functionality, and then switch altogether

to an unrelated area, to determine whether any accumulated state infor-

mation has an effect on the application’s behavior.

Example 5: Erasing an Audit Trail

The authors encountered this logic flaw in a web application used in a call center.