The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

HACK STEPS

The flaws in this application were absolutely fundamental to its security, but

none of them would have been identified by an attacker who simply

intercepted browser requests and modified the parameter values being

submitted.

■

Whenever an application implements a key action across multiple stages,

you should take parameters that are submitted at one stage of the

process, and try submitting these to a different stage. If the relevant

items of data are updated within the application’s state, you should

explore the ramifications of this behavior, to determine whether you can

leverage it to carry out any malicious action, as in the preceding three

examples.

■

If the application implements functionality whereby different categories