OAT-005 Scalping - Revision history

Clerkendweller: /* Indicative Diagram */

2018-02-16T15:05:31Z

‎Indicative Diagram

Clerkendweller: /* Cross-References */

2018-02-16T11:47:42Z

‎Cross-References

Clerkendweller at 10:20, 16 February 2018

2018-02-16T10:20:53Z

Clerkendweller: New page

2018-02-16T10:15:29Z

New page

New page

__NOTOC__

This is an automated threat. To view all automated threats, please see the [[:Category:Automated Threat|Automated Threat Category]] page. The OWASP Automated Threat Handbook - Wed Applications ([https://www.owasp.org/index.php/File:Automated-threat-handbook.pdf pdf], print), an output of the [[OWASP Automated Threats to Web Applications|OWASP Automated Threats to Web Applications Project]], provides a fuller guide to each threat, detection methods and countermeasures. The [https://www.owasp.org/index.php/File:Oat-ontology-decision-chart.pdf threat identification chart] helps to correctly identify the automated threat.

== Definition ==

===OWASP Automated Threat (OAT) Identity Number ===

OAT-005

===Threat Event Name===

Scalping

=== Summary Defining Characteristics===

Obtain limited-availability and/or preferred goods/services by unfair methods.

===Indicative Diagram===

=== Description ===

Acquisition of goods or services using the application in a manner that a normal user would be unable to undertake manually.

Although Scalping may include monitoring awaiting availability of the goods or services, and then rapid action to beat normal users to obtain these, Scalping is not a "last minute" action like [[OAT-013 Sniping]], nor just related to automation on behalf of the user such as in [[OAT-006 Expediting]]. This is because Scalping includes the additional concept of limited availability of sought-after goods or services, and is most well known in the ticketing business where the tickets acquired are then resold later at a profit by the scalpers/touts. This can also lead to a type of user denial of service, since the goods or services become unavailable rapidly.

=== Other Names and Examples ===

Bulk purchase; Purchase automaton; Purchase bot; Restaurant table/hotel room reservation speed-booking; Queue jumping; Sale stampede; Secondary ticketing; Ticket resale; Ticket scalping; Ticket touting

=== See Also ===

* [[OAT-006 Expediting]]
* [[OAT-013 Sniping]]
* [[OAT-015 Denial of Service]]
* [[OAT-021 Denial of Inventory]]

== Cross-References ==

=== CAPEC Category / Attack Pattern IDs ===

* 210 Abuse of Functionality

=== CWE Base / Class / Variant IDS ===

* 799 Improper Control of Interaction Frequency
* 837 Improper Enforcement of a Single, Unique Action

=== WASC Threat IDS ===

* 21 Insu icient Anti-Automation
* 42 Abuse of Functionality

=== OWASP Attack Category / Attack IDs ===

* [[:Category:Abuse of Functionality]]

[[Category: Automated Threat]]

@@ Line 19: / Line 19: @@
 ===Indicative Diagram===
+[[File:OAT-005_Scalping.png|500px|link=]]
 === Description ===

@@ Line 44: / Line 44: @@
 * 210 Abuse of Functionality
-=== CWE Base / Class / Variant IDS ===
+=== CWE Base / Class / Variant IDs ===
 * 799 Improper Control of Interaction Frequency
 * 837 Improper Enforcement of a Single, Unique Action
-=== WASC Threat IDS ===
+=== WASC Threat IDs ===
 * 21 Insufficient Anti-Automation

@@ Line 51: / Line 51: @@
 === WASC Threat IDS ===
-* 21 Insu icient Anti-Automation
+* 21 Insufficient Anti-Automation
 * 42 Abuse of Functionality
 === OWASP Attack Category / Attack IDs ===
-* [[:Category:Abuse of Functionality]]
+* [[:Category:Abuse of Functionality|Abuse of Functionality]]
 [[Category: Automated Threat]]