The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

362

Chapter 11 

■

Attacking Application Logic

70779c11.qxd:WileyRed  9/14/07  3:14 PM  Page 362

---

added. A crafty user could add to his basket large quantities of every single

product on sale from the vendor, to attract the maximum possible bulk dis-

counts. When the discounts had been applied to items in the shopping basket,

he could remove items he did not require and still receive the discounts

applied to the remaining products.

HACK STEPS

■

In any situation where prices or other sensitive values are adjusted

based on criteria that are determined by user-controllable data or

actions, first understand the algorithms used by the application, and the

point within its logic where adjustments are made. Identify whether