Testing for the circumvention of workflows
The workflow must be stopped with all actions and new activities rolled back or canceled if the user fails to complete particular stages in the right/precise order, as required by the application’s business logic. This lab makes assumptions that are inherently fallible about the sequence of events in the application’s purchasing business workflow. In this recipe, the attacker (you) will exploit a defect to purchase a leather jacket at no additional cost to the user.
Getting ready
For this recipe, you will need to start PortSwigger’s Insufficient workflow validation lab and ensure that ZAP is intercepting traffic between the lab application and your browser.
How to do it…
In this lab, we will demonstrate how to circumvent the item purchasing workflow by adding an item to the cart without an increase in price. Follow these steps to circumvent the purchasing workflow:
- Navigate to the URL with the...
