312-39V2: Certified SOC Analyst v2

Question

An attacker exploits the logic-validation mechanisms of an e-commerce website. He successfully purchases a product worth $100 for $10 by modifying the URL exchanged between the client and server.

Original URL: http://www.buyonline.com/product.aspx?profile=12&debit=100

Modified URL: http://www.buyonline.com/product.aspx?profile=12&debit=10

Identify the attack illustrated in this scenario.

Explanation

Parameter tampering occurs when an attacker modifies client-controlled request parameters, such as URL query values, to bypass server-side business logic. Altering the debit value from 100 to 10 changes the charged amount.

312-39V2: Certified SOC Analyst v2

AstroTutor

Notes

Readiness

QuestionQ132

Community Discussion