The Basic Vulnerabilities of the Web--Logical Vulnerabilities

Table of contents

1. Introduction to logic loopholes

1. The principle of logical loopholes

2. Classification of Logic Vulnerabilities

3. Common logical loopholes

4. Digging for logical loopholes

---

 

1. Introduction to logic loopholes

1. The principle of logical loopholes

Logical loopholes refer to attacks due to lax program logic or too complex logic, resulting in some logic branches not being able to process normally or processing errors. Generally, any password modification (without old password verification), unauthorized access, password retrieval, transaction payment amount, etc. will occur.

2. Classification of Logic Vulnerabilities

1. Override Vulnerabilities
2. Password needs to be changed
3. recover password
4. captcha vulnerability
5. payment loophole
6. Voting/Points/Sweepstakes
7. SMS bombing

3. Common logical loopholes

Various logical loopholes such as transaction payment, password modification, password retrieval, unauthorized modification, unauthorized query, and breakthrough of restrictions.

4. Digging for logical loopholes

Determine the business process ---> find the link that can be manipulated in the process ---> analyze the logic problems that may arise in the link that can be manipulated ---> try to modify the parameters to trigger the logic problem