The Web Application Hacker's Handbook by Dafydd Stuttard & Marcus Pinto
Author:Dafydd Stuttard & Marcus Pinto
Language: eng
Format: epub
Publisher: John Wiley & Sons
Published: 2011-08-30T04:00:00+00:00
The Attack
When the assumption is explicitly stated in this way, the logic flaw becomes obvious. Of course, an ordinary user could issue a request that did not contain an existing password parameter, because users controlled every aspect of the requests they issued.
This logic flaw was devastating for the application. It enabled an attacker to reset the password of any other user and take full control of that person's account.
Hack Steps
1. When probing key functionality for logic flaws, try removing in turn each parameter submitted in requests, including cookies, query string fields, and items of POST data.
2. Be sure to delete the actual name of the parameter as well as its value. Do not just submit an empty string, because typically the server handles this differently.
3. Attack only one parameter at a time to ensure that all relevant code paths within the application are reached.
4. If the request you are manipulating is part of a multistage process, follow the process through to completion, because some later logic may process data that was supplied in earlier steps and stored within the session.
Download
This site does not store any files on its server. We only index and link to content provided by other sites. Please contact the content providers to delete copyright contents if any and email us, we'll remove relevant links or contents immediately.
Effective Threat Investigation for SOC Analysts by Yahia Mostafa;(6590)
Practical Memory Forensics by Svetlana Ostrovskaya & Oleg Skulkin(6312)
Machine Learning Security Principles by John Paul Mueller(6284)
Attacking and Exploiting Modern Web Applications by Simone Onofri & Donato Onofri(5959)
Operationalizing Threat Intelligence by Kyle Wilhoit & Joseph Opacki(5919)
Solidity Programming Essentials by Ritesh Modi(4048)
Microsoft 365 Security, Compliance, and Identity Administration by Peter Rising(3687)
Operationalizing Threat Intelligence by Joseph Opacki Kyle Wilhoit(3418)
Mastering Python for Networking and Security by José Manuel Ortega(3357)
Future Crimes by Marc Goodman(3351)
Mastering Azure Security by Mustafa Toroman and Tom Janetscheck(3337)
Blockchain Basics by Daniel Drescher(3306)
Learn Computer Forensics - Second Edition by William Oettinger(3175)
Incident Response with Threat Intelligence by Roberto MartÃnez(2903)
Mobile App Reverse Engineering by Abhinav Mishra(2887)
Mastering Bitcoin: Programming the Open Blockchain by Andreas M. Antonopoulos(2873)
The Code Book by Simon Singh(2832)
From CIA to APT: An Introduction to Cyber Security by Edward G. Amoroso & Matthew E. Amoroso(2783)
Building a Next-Gen SOC with IBM QRadar: Accelerate your security operations and detect cyber threats effectively by Ashish M Kothekar(2775)
