Foundstone Hacme Books v2. 0™ Strategic Secure Software Training Application User and Solution Guide Author: Roman Hustad, Foundstone Professional. Hacme Bank. From OWASP. Redirect page. Jump to: navigation, search. Redirect to: OWASP O2 Platform/WIKI/Using O2 on: HacmeBank. Foundstone Hacme Books™ is a learning platform for secure software development and is targeted at software developers, application.

Author: Fesho Meztijin
Country: Congo
Language: English (Spanish)
Genre: History
Published (Last): 19 November 2009
Pages: 116
PDF File Size: 6.92 Mb
ePub File Size: 5.98 Mb
ISBN: 426-6-35224-148-6
Downloads: 40871
Price: Free* [*Free Regsitration Required]
Uploader: Meztinos

In two values, the first two letters are again the same.

Hacme Books 2.0 Download

This can be very tricky and there is an endless list of operations that can be performed by using this attack. This is the fourth in a series of five oboks for the vulnerable web application Hacme Books. The hacmd must be created on the system so it is obvious that we will create bogus accounts, here I am going to create two accounts named test and hacker. Hacme Books follows an MVC architecture that leverages the inversion of control design patterns to drive factory configuration.

The developers will never show the discount amount in plaintext to be subtracted from the price of the book.

Hacme Books Week 5 | Web App Pentesting

Email required Address never made public. So the value we get would look like: Normally, the security side of things consists of tools that are used by the testers and quality control team after the programmers write the code hxcme develop the application.


So an attacker goes to website like any other user to buy a book. Broken Access Control Access control is one of the major security concerns in any application. It is usually difficult for the developers to figure out if the code they are writing is secure or not and normally this is discovered only when the application is ready to be deployed. Leave a Reply Cancel reply Enter your comment here This attack scenario highlighted hcame major boooks during working with this application.

It is possible to overlook booms access control scenarios that are horizontal in nature. Before that we have to start the web server that will display the application pages. By default the install location is C: After successfully starting the tomcat server, open the web browser and go to http: Second, there is no horizontal privilege check.

This entry was posted in Uncategorized. You are commenting using your Twitter account.

Because of SQL Injection, a user can modify the amount of discount on any book! You are commenting using your Facebook account. O represents Zero in actual number. Most of the information that is used by the backend system is jumbled — encrypted to be precise. Fill in your details below or click an icon to log in: This is the first in a series of three posts for the vulnerable web application Hacme Books.

Leave the default option checked for install location. Hacme Books is designed to enable the programmers to write the secure code. Once the installation is finished we will go ahead and test the installed application. New posts for Hacme Books will post every Monday. After a careful analysis it is not hard to figure out that the developer has used a simple substitution algorithm to get the values of the discount to be given.


Fill in your details below or click an icon to log in: We will need to have a couple nacme user accounts on the system and will need to complete a couple of purchases. Hacme Books comes in three formats: In this case, I, as an attacker, will try to look at my profile or any previous order.

First I will logon with the test account, we have not made any purchase using this account, so if we click on view orders we will see the screen with message that explains that this user has never purchased anything.

Hacme Bank

In fact, that was the platform to launch the attack. Now that we have the method, it is possible to get as much discount as we want and whatever we use would be validated books we know how it works and we can put in the values straight in a custom HTTP request.

So the developers use a random code to identify the percentage of the discount on any particular item. A careful look on the codes below reveals some interesting information.