Skip to content

lab5.md

Latest commit

 

History

History
57 lines (40 loc) · 2.53 KB

lab5.md

File metadata and controls

57 lines (40 loc) · 2.53 KB
Raw

Lab 5 Practice - Understanding Business Logic Flaws

Overview:

Business logic flaws are vulnerabilities that occur when an application does not enforce the rules of its business logic. These flaws can be exploited by attackers to perform unauthorized actions, leading to negative outcomes. Understanding these flaws is crucial for developers and security professionals to protect applications effectively.

Question 1:

What are three examples of business logic flaws that could enable an attacker to use legitimate transactions and application flows in a way that results in a negative outcome? (Choose all that apply.)

  • Unverified Ownership
  • Cross-Site Request Forgery (CSRF)
  • Improper Enforcement of a Behavioral Workflow
  • SQL Injection
  • Authentication Bypass Using an Alternate Path
  • Cross-Site Scripting (XSS)

Question 2:

Scenario: An e-commerce platform allows users to change their delivery address without verifying ownership of the account. What type of business logic flaw does this represent?

  • Authorization Flaw
  • Data Integrity Issue
  • Session Management Vulnerability

Question 3:

In a banking application, users can initiate fund transfers without a two-step verification process. What could this flaw potentially allow an attacker to do?

  • Access sensitive user information
  • Execute unauthorized transactions
  • Bypass user authentication entirely

Question 4:

True or False: Proper input validation can mitigate the risk of business logic flaws in an application.

  • True
  • False

Question 5:

Which of the following practices can help prevent business logic flaws? (Choose all that apply.)

  • Thorough Testing of Business Workflows
  • Implementing Role-Based Access Control
  • User Education on Security Best Practices
  • Regular Security Audits and Code Reviews

Submission Instructions:

  1. Complete the questions above by selecting the correct answers.
  2. Submit your responses via the designated learning management system or email them to your instructor.
  3. Ensure your answers are well-justified, especially for scenario-based questions, to demonstrate your understanding of the concepts discussed.

Additional Resources:

  • Articles on Common Business Logic Flaws
  • Videos Explaining Security Best Practices
  • Case Studies of Security Breaches Due to Business Logic Flaws