Testing for the circumvention of workflows

Shopping cart to payment gateway interactions must be tested by web application penetration testers to ensure the workflow cannot be performed out of sequence. A payment should never be made unless verification of the cart contents is checked on the server side first. In the event this check is missing, an attacker can change the price, quantity, or both, prior to the actual purchase.

Getting ready

Using the OWASP WebGoat application and Burp, we will exploit a business logic design flaw in which there is no server-side validation prior to a purchase.

How to do it...

1. Ensure the owaspbwa VM is running. Select the OWASP WebGoat application from the initial landing page of the VM. The landing page will be configured to an IP address specific to your machine.
2. After you’ve clicked the OWASP WebGoat link, you will be prompted for login credentials. Use these credentials—username: guest; password: guest.
3. After...