Talk Title: Ineluctable weakness of logical vulnerabilities

No ratings

Presented at bsidesdelhi 2017 by

Ankit Giri

Abstract: This talk covers patterns that we have found in web applications while exploring business logic flaws. Business logic vulnerabilities make up only 5%-10% of the total vulnerabilities out there. These are difficult to detect but have the highest impact. There are multiple sources of information for legacy security vulnerabilities in applications such as OWASP & WASC. Hackers and pentesters try finding these legacy bugs using their experience and the common exploit scenarios known to them. The steps to follow searching for such bugs are available across the internet. On the other hand, when we talk about a business logic bug or a logical flaw, there seems to be much less information available, as there is no specific exploit scenario. These bugs vary drastically from one application to another. Business logic flaws are much more complex than they appear to be, because one can create a computer program according to the need or the logic the program intends to perform. However, it is difficult to predict the logical point of failures. Read More