Testing for business logic - Revision history

Andrew Muller: Andrew Muller moved page Testing for business logic (OWASP-BL-001) to Testing for business logic over redirect: Testing for business logic is now a chapter heading supported by several test cases rather than being the only test case.

2014-08-05T12:29:17Z

Andrew Muller moved page Testing for business logic (OWASP-BL-001) to Testing for business logic over redirect: Testing for business logic is now a chapter heading supported by several test cases rather than being the only test case.

Jane O'Connor: Added Andrew's changes.

2014-08-01T21:13:13Z

Added Andrew's changes.

Jane O'Connor: Final edit

2014-05-19T11:13:24Z

Final edit

Show changes

David Fern at 13:19, 16 December 2013

2013-12-16T13:19:56Z

David Fern at 13:16, 16 December 2013

2013-12-16T13:16:21Z

David Fern at 13:15, 16 December 2013

2013-12-16T13:15:57Z

David Fern at 12:10, 3 December 2013

2013-12-03T12:10:20Z

David Fern at 12:09, 3 December 2013

2013-12-03T12:09:38Z

David Fern at 12:08, 3 December 2013

2013-12-03T12:08:30Z

David Fern at 11:59, 3 December 2013

2013-12-03T11:59:53Z

@@ Line 2: / Line 2: @@
-== Brief Summary of Business Logic Vulnerability==
+== Summary ==
 Testing for business logic flaws in a multi-functional dynamic web application requires thinking in unconventional methods. If an application's authentication mechanism is developed with the intention of performing steps 1, 2, 3 in that specific order to authenticate a user. What happens if the user goes from step 1 straight to step 3? In this simplistic example, does the application provide access by failing open; deny access, or just error out with a 500 message?
@@ Line 94: / Line 94: @@
 In malicious file upload testing, we verify that the application does not allow users to upload files to the system that are malicious or potentially malicious to the system security. This is important because without these safeguards in place attackers may be able to upload files to the system that may spread viruses, malware or even exploits such as shellcode when executed.
@@ Line 156: / Line 209: @@
 *The Decision Model: A Business Logic Framework Linking Business and Technology, By Barbara Von Halle, Larry Goldberg, Published by CRC Press, ISBN1420082817 (2010)

@@ Line 101: / Line 101: @@
 *Seven Business Logic Flaws That Put Your Website At Risk – Jeremiah Grossman Founder and CTO, WhiteHat Security - https://www.whitehatsec.com/resource/whitepapers/business_logic_flaws.html
-*Toward Automated Detection of Logic Vulnerabilities in Web Applications - Viktoria Felmetsger Ludovico Cavedon Christopher Kruegel Giovanni Vigna - http://www.usenix.org/events/sec10/tech/full_papers/Felmetsger.pdf
+*Toward Automated Detection of Logic Vulnerabilities in Web Applications - Viktoria Felmetsger Ludovico Cavedon Christopher Kruegel Giovanni Vigna - https://www.usenix.org/legacy/event/sec10/tech/full_papers/Felmetsger.pdf
-*2012 Web Session Intelligence & Security Report: Business Logic Abuse, Dr. Ponemon - http://buzz.silvertailsystems.com/PonemonStudy.html?/study and http://www.silvertailsystems.com/downloads/PonemonUS_Full_Report.pdf
+*2012 Web Session Intelligence & Security Report: Business Logic Abuse, Dr. Ponemon - http://www.emc.com/collateral/rsa/silvertail/rsa-silver-tail-ponemon-ar.pdf
 *2012 Web Session Intelligence & Security Report: Business Logic Abuse (UK) Edition, Dr. Ponemon - http://buzz.silvertailsystems.com/Ponemon_UK.htm
@@ Line 111: / Line 111: @@
 *Business Logic Attacks – Bots and Bats, Eldad Chai - http://www.imperva.com/resources/adc/pdfs/AppSecEU09_BusinessLogicAttacks_EldadChai.pdf
-*Detail Misuse Cases - https://www.owasp.org/index.php/Detail_misuse_cases
+*OWASP Detail Misuse Cases - https://www.owasp.org/index.php/Detail_misuse_cases
 *How to Prevent Business Flaws Vulnerabilities in Web Applications, Marco Morana -  http://www.slideshare.net/marco_morana/issa-louisville-2010morana
@@ Line 176: / Line 176: @@
 * Session Manager - https://chrome.google.com/webstore/detail/bbcnbpafconjjigibnhbfmmgdbbkcjfi
-With Session Manager you can quickly save your current browser state and reload it whenever necessary. You can manage multiple sessions, rename or remove them from the session library. Each session remembers the state of the browser at its creation time, i.e the opened tabs and windows.
+With Session Manager you can quickly save your current browser state and reload it whenever necessary. You can manage multiple sessions, rename or remove them from the session library. Each session remembers the state of the browser at its creation time, i.e. the opened tabs and windows.
 Once a session is opened, the browser is restored to its state.
 * Cookie Swap - https://chrome.google.com/webstore/detail/dffhipnliikkblkhpjapbecpmoilcama?hl=en-US
-Swap My Cookies is a session manager, it manages your cookies, letting you login on any website with several different accounts. You can finally  login into gmail, yahoo, hotmail, and just any website you use, with all your accounts; if you want to use another account just swap profile!
+Swap My Cookies is a session manager, it manages your cookies, letting you login on any website with several different accounts. You can finally  login into Gmail, yahoo, hotmail, and just any website you use, with all your accounts; if you want to use another account just swap profile!
 * HTTP Response Browser - https://chrome.google.com/webstore/detail/mgekankhbggjkjpcbhacjgflbacnpljm?hl=en-US
-Make HTTP requests from you browser and browse the response (HTTP headers and source). Send HTTP method, headers and body using XMLHttpRequest from you browser then view the HTTP status, headers and source. Click links in the headers or body to issue new requests. This plugin formats XML responses and uses SyntaxHighlighter < http://alexgorbatchev.com/ >.
+Make HTTP requests from your browser and browse the response (HTTP headers and source). Send HTTP method, headers and body using XMLHttpRequest from your browser then view the HTTP status, headers and source. Click links in the headers or body to issue new requests. This plug-in formats XML responses and uses Syntax Highlighter < http://alexgorbatchev.com/ >.
 * Firebug lite for Chrome - https://chrome.google.com/webstore/detail/bmagokdooijbeehmkpknfglimnifench

← Older revision		Revision as of 13:16, 16 December 2013
Line 66:		Line 66:

	[[Testing for the Circumvention of Work Flows (OTG-BUSLOGIC-009)\|4.12.6 Testing for the Circumvention of Work Flows (OTG-BUSLOGIC-006)]]		[[Testing for the Circumvention of Work Flows (OTG-BUSLOGIC-009)\|4.12.6 Testing for the Circumvention of Work Flows (OTG-BUSLOGIC-006)]]
−

	In circumventing workflow and bypassing correct sequence testing, we verify that the application does not allow users to perform actions outside of the “approved/required” business process flow. This is important because without this safeguard in place attackers may be able to bypass or circumvent workflows and “checks” allowing them to prematurely enter or skip “required” sections of the application potentially allowing the action/transaction to be completed without successfully completing the entire business process, leaving the system with incomplete backend tracking information.		In circumventing workflow and bypassing correct sequence testing, we verify that the application does not allow users to perform actions outside of the “approved/required” business process flow. This is important because without this safeguard in place attackers may be able to bypass or circumvent workflows and “checks” allowing them to prematurely enter or skip “required” sections of the application potentially allowing the action/transaction to be completed without successfully completing the entire business process, leaving the system with incomplete backend tracking information.

@@ Line 46: / Line 46: @@
 [[Test business logic data validation (OTG-BUSLOGIC-001)|4.12.1 Test business logic data validation (OTG-BUSLOGIC-001)]]
 [[Test Ability to forge requests (OTG-BUSLOGIC-002)|4.12.2 Test Ability to forge requests (OTG-BUSLOGIC-002)]]
 [[Test integrity checks (OTG-BUSLOGIC-003)|4.12.3 Test Integrity Checks (OTG-BUSLOGIC-003)]]
 [[Test for Process Timing (OTG-BUSLOGIC-007)|4.12.4 Test for Process Timing (OTG-BUSLOGIC-004)]]
 [[Test number of times a function can be used limits (OTG-BUSLOGIC-007)|4.12.5 Test Number of Times a Function Can be Used Limits (OTG-BUSLOGIC-005)]]
 [[Testing for the Circumvention of Work Flows (OTG-BUSLOGIC-009)|4.12.6 Testing for the Circumvention of Work Flows (OTG-BUSLOGIC-006)]]
 [[Test defenses against application mis-use (OTG-BUSLOGIC-011)|4.12.7 Test Defenses Against Application Mis-use (OTG-BUSLOGIC-007)]]
 [[Test Upload of Unexpected File Types (OTG-BUSLOGIC-015)|4.12.8 Test Upload of Unexpected File Types (OTG-BUSLOGIC-008)]]
 [[Test Upload of Malicious Files (OTG-BUSLOGIC-016)|4.12.9 Test Upload of Malicious Files (OTG-BUSLOGIC-009)]]
 ==References==

← Older revision		Revision as of 12:10, 3 December 2013
Line 50:		Line 50:

	[[Test integrity checks (OTG-BUSLOGIC-003)\|4.12.3 Test Integrity Checks (OTG-BUSLOGIC-003)]]		[[Test integrity checks (OTG-BUSLOGIC-003)\|4.12.3 Test Integrity Checks (OTG-BUSLOGIC-003)]]
−
−	~~[[4.12.3 Test Integrity Checks (OTG-BUSLOGIC-003)]]~~

	[[Test for Process Timing (OTG-BUSLOGIC-007)\|4.12.4 Test for Process Timing (OTG-BUSLOGIC-004)]]		[[Test for Process Timing (OTG-BUSLOGIC-007)\|4.12.4 Test for Process Timing (OTG-BUSLOGIC-004)]]

← Older revision	Revision as of 12:29, 5 August 2014
(No difference)

@@ Line 53: / Line 53: @@
 [[4.12.3 Test Integrity Checks (OTG-BUSLOGIC-003)]]
-[[4.12.4 Test Tamper Evidence (OTG-BUSLOGIC-004)]]
+[[Test for Process Timing (OTG-BUSLOGIC-007)|4.12.4 Test for Process Timing (OTG-BUSLOGIC-004)]]
-[[4.12.5 Test Excessive Rate (speed) of Use Limits (OTG-BUSLOGIC-005)]]
+[[Test number of times a function can be used limits (OTG-BUSLOGIC-007)|4.12.5 Test Number of Times a Function Can be Used Limits (OTG-BUSLOGIC-005)]]
-[[4.12.6 Test for Process Timing (OTG-BUSLOGIC-006)]]
+[[Testing for the Circumvention of Work Flows (OTG-BUSLOGIC-009)|4.12.6 Testing for the Circumvention of Work Flows (OTG-BUSLOGIC-006)]]
-[[4.12.7 Test Size of Request Limits (OTG-BUSLOGIC-007) ]]
+[[Test defenses against application mis-use (OTG-BUSLOGIC-011)|4.12.7 Test Defenses Against Application Mis-use
-[[4.12.8 Test Number of Times a Function Can be Used Limits (OTG-BUSLOGIC-008) ]]
+[[Test Upload of Unexpected File Types (OTG-BUSLOGIC-015)|4.12.8 Test Upload of Unexpected File Types (OTG-BUSLOGIC-008)]]
-[[4.12.9 Test bypass of Correct Sequence (OTG-BUSLOGIC-009) ]]
+[[Test Upload of Malicious Files (OTG-BUSLOGIC-016)|4.12.9 Test Upload of Malicious Files (OTG-BUSLOGIC-009)]]
 ==References==

← Older revision		Revision as of 11:59, 3 December 2013
Line 48:		Line 48:

	[[Test Ability to forge requests (OTG-BUSLOGIC-002)\|4.12.2 Test Ability to forge requests (OTG-BUSLOGIC-002)]]		[[Test Ability to forge requests (OTG-BUSLOGIC-002)\|4.12.2 Test Ability to forge requests (OTG-BUSLOGIC-002)]]
		+
		+	[[Test integrity checks (OTG-BUSLOGIC-003)\|4.12.3 Test Integrity Checks (OTG-BUSLOGIC-003)]]

	[[4.12.3 Test Integrity Checks (OTG-BUSLOGIC-003)]]		[[4.12.3 Test Integrity Checks (OTG-BUSLOGIC-003)]]