Re: View and edit hidden HTML form fields (fwd)

On Thursday 12 June 2003 03:02 pm, sirkus wrote:
> On Thu, 2003-06-12 at 12:22, Tim Greer wrote:

<snip>

> >
> > I actually don't see how this reveals any weaknesses. Just seeing
> > the fields or arguments/values passed to a script/program doesn't

<snip>

> full explanation... Yes, tools like this can be used to test for

Indeed. A real-world example follows:

Context: an on-line banking application which allows the user to do account balance inquiry and transfer funds between accounts. The application was poorly designed and naively trusted data from the browser. When the user logged in, the application looked up all of the accounts to which the user had legitimate access and sent the account numbers out to the browser. The user could then choose which account he/she wanted to access. In the case of transferring funds, the user selected the "from" and "to" accounts. Problem was, upon receipt of the form, the application did not validate that the accounts were owned by the user. This meant that if the user could directly manipulate the contents of the POST, he/she could inquire about *anyone's* balance, and transfer funds from *anyone's* account to *anyone else's* account. This was tested and exploited using a tool such as is being discussed here during the Information Security audit before the application was actually put into production.

Do you need help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related securityfocus.com Links bugtraq certification focus-bsd focus-ids focus-ih focus-linux focus-ms focus-sun focus-unix-other focus-virus forensics incidents libnet linux-secnews ms-secnews pen-test secpapers secprog sectools secureshell security-basics securityjobs sf-news vuln-dev webappsec Request more information about Pantek

</gwc>

-- 
George W. Capehart

"With sufficient thrust, pigs fly just fine . . ."
 -- RFC 1925