0

I came across this question on cybrary about the attack to be used to modify prices on a website. First off, I'm assuming that by prices they mean prices of a product like on an E-Commerce website.(Please correct me if I'm wrong). The answer to this question is hidden form fields. I wonder how is that possible.

According to my knowledge, hidden form fields are an alternative for HTTP's stateless nature. They act as a session token, much like cookies do. How can one use hidden values to modify prices. In my opinion the answer should be SQL Injection as it can be used to modify the content of a database. Any idea?

  • Ugh. The thing you link is an online multiple choice test. I have zero confidence in those things. A "register pleeze or no answer" delayed splash screen obscuring the content doesn't help. – John Dvorak Jun 11 '17 at 11:31
  • @JanDvorak: Yeah! I just checked that it won't show you the answer without you creating an account. No need to create one. It simply displays the answer as 'Option b'. Anyway, do you think it's possible to do what I mentioned? – 7_R3X Jun 11 '17 at 11:42
  • You should stop using that website. This question is misleading. The right answer would be "whatever attack hits an exploitable vulnerability the developers and sysadmins of the website haven't considered". And any of the four answers could theoretically be a part of such an attack. – Philipp Jun 11 '17 at 17:56
2

According to my knowledge, hidden form fields are an alternative for HTTP's stateless nature. They act as a session token, much like cookies do. How can one use hidden values to modify prices?

Hidden form fields cause some data to be sent with a form. For example:

<form method="POST" action="/post_answer">
    <textarea name="answer"></textarea>
    <input type="hidden" name="question_id" value="161719">
</form>

This way, if I type an answer in the textarea, the server knows that this answer is for question 161719.

This is different from a session token. A session token is stored in a cookie and identifies the session. What you perhaps mean is that the question ID could be stored in the session instead. That is true, with a slight change in behavior: if I visit multiple questions in multiple tabs and answer them out of order, the question id in the session will be incorrect. The one posted with the answer in the hidden form field will still be correct.

So, how can you modify prices? If the form looks like this:

<form method="POST" action="/finish_order">
    Enter your shipping address: <textarea name="address"></textarea>
    <input type="hidden" name="price_to_pay" value="$123.45">
    <input type="hidden" name="order_id" value="6789">
</form>

Here the price_to_pay is sent to finish_order, and you are charged with $123.45. However, you can easily modify this value to be charged less. Whether this works and whether your order still ships depends on the implementation of the website, and the procedurial checks in place.

1

If a hacker wanted to modify prices on a website, which of the below methods would they use? As an aside, there are no alerts shown through IDS.

This is not a lot of context or detail for a question like this. It kind of depends what "modify prices" means.

XSS

If the website is vulnerable to XSS, XSS can be used to modify the appearances of the website. This means the price shown on the website can be changed.

Hidden form fields

If during checkout the website stores the amount to pay in a hidden form field without further validation, an visitor may change the value of this form field and pay less for the ordered item. So the price to pay can be modified.

SQL injection

SQL injection makes it possible to alter data in the database. Presumable the prices are stored in the database and can be changed, so this would also allow to modify prices. However, this one is most likely to show an alert in an IDS.

Port scanning

No, port scanning can not be used to modify prices.

  • Port scanning can still reveal an ACE vulnerability, can't it? – John Dvorak Jun 11 '17 at 11:46
0

Multiple choice questions like this are often ambiguous and can have more than one valid answer.

While you are correct in that SQL injection can be used to modify prices, the key here is that there are no IDS alerts so with a well configured IDS that is looking for injection, that would leave a trace.

Some poor implementations of e-commerce sites load the product data and use hidden fields to store the price which is passed onto the payment service. This is more common where an online shop needs to communicate prices with a third party payment gateway.

So, the attack in this case would be identify the hidden field that contains your price, edit it to be a penny through standard developer tools in the browser and complete the transaction as normal

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.