The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

which can be used to better understand its internal workings and thereby

fine-tune the current or a different attack (see Chapter 14). Sometimes,

the application may get into a state entirely unanticipated by developers,

which may lead to serious security flaws.

70779c11.qxd:WileyRed  9/14/07  3:14 PM  Page 353

---

N OT E

Many types of access control vulnerability are similar in nature 

to this logic flaw. When a privileged function involves multiple stages that are

normally accessed in a defined sequence, the application may assume that

users will always proceed through the functionality in this sequence. The

application may enforce strict access control on the initial stages of the process

and assume that any user who reaches the later stages must, therefore, be