The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

N OT E

Many kinds of web applications employ numeric limits within their

business logic. For example:

■■

A retailing application may prevent a user from ordering more than the

number of units available in stock.

■■

A banking application may prevent a user from making bill payments

that exceed her current account balance.

■■

An insurance application may adjust its quotations based on age

thresholds.

Finding a means of beating such limits will often not represent a security

compromise of the application itself. However it may have serious business

consequences and represent a breach of the controls that the owner is relying

on the application to enforce.

Chapter 11 

■

Attacking Application Logic  361

70779c11.qxd:WileyRed  9/14/07  3:14 PM  Page 361

---