1. Authentication
- Brute Force
- Insufficient Authentication
- Weak Password Recovery Validation
2. Authorization
- Credential/Session Prediction
- Insufficient Authorization
- Insufficient Session Expiration
- Session Fixation
3. Client-side Attacks
- Content Spoofing
- Cross-site Scripting
4. Command Execution
- Buffer Overflow
- Format String Attack
- LDAP Injection
- OS Commanding
- SQL Injection
- SSI Injection
- XPath Injection
5. Information Disclosure
- Directory Indexing
- Information Leakage
- Path Traversal
- Predictable Resource Location
6. Logical Attacks
- Abuse of Functionality
- Denial of Service
- Insufficient Anti-automation
- Insufficient Process Validation
|
 |
Insufficient Process Validation
Insufficient Process Validation is when a web site permits an attacker
to bypass or circumvent the intended flow control of an application. If
the user state through a process is not verified and enforced, the web
site could be vulnerable to exploitation or fraud.
When a user performs a certain web site function, the application
may expect the user to navigate through a specific order sequence.
If the user performs certain steps incorrectly or out of order, a data
integrity error occurs. Examples of multi-step processes include wire
transfer, password recovery, purchase checkout, account signup, etc.
These processes will likely require certain steps to be performed as
expected.
For multi-step processes to function properly, web sites are required
to maintain user state as the user traverses the process flow. Web
sites will normally track a users state through the use of cookies or
hidden HTML form fields. However, when tracking is stored on the
client side within the web browser, the integrity of the data must be
verified. If not, an attacker may be able to circumvent the expected
traffic flow by altering the current state.
Example
An online shopping cart system may offer to the user a discount if
product A is purchased. The user may not want to purchase product
A, but product B. By filling the shopping cart with product A and
product B, and entering the checkout process, the user obtains the
discount. The user then backs out of the checkout process, and
removes product A, or simply alters the values before submitting to
the next step. The user then reenters the checkout process, keeping
the discount already given in the previous checkout process with
product A in the shopping cart, and obtains a fraudulent purchase
price.
References
"Dos and Don'ts of Client Authentication on the Web", Kevin Fu, Emil
Sit, Kendra Smith, Nick Feamster - MIT Laboratory for Computer Science
http://cookies.lcs.mit.edu/pubs/webauth:tr.pdf
To receive your Free Application
Vulnerability Assessment for testing of one attack vulnerability of your choice, please submit your payment of $1999.00 for a second Insufficient Process Validation attack vulnerability test.
|
