admin管理员组

文章数量:1558103

  1. 查看要求

     This lab doesn't adequately validate user input. You can exploit a logic flaw in its purchasing workflow to buy items for an unintended price. To solve the lab, buy a "Lightweight l33t leather jacket".
    
    You can log in to your own account using the following credentials: wiener:peter
    
  2. 开启环境

  3. 使用给定的账号密码登录

  4. 点入皮夹克进行购买,添加到购物车,抓包

  5. 此时购物车中显示商品信息

  6. 查看抓包内容,此时可以随意更改价格和数量

    productId=1&redir=PRODUCT&quantity=1&price=001
    

  7. 刷新购物车页面,即可1分钱购买

本文标签: trustexcessiveCLIENTcontrolsSide