CAPEC-162 Manipulating Hidden Fields

An adversary exploits a weakness in the server's trust of client-side processing by modifying data on the client-side, such as price information, and then submitting this data to the server, which processes the modified data. For example, eShoplifting is a data manipulation attack against an on-line merchant during a purchasing transaction. The manipulation of price, discount or quantity fields in the transaction message allows the adversary to acquire items at a lower cost than the merchant intended. The adversary performs a normal purchasing transaction but edits hidden fields within the HTML form response that store price or other information to give themselves a better deal. The merchant then uses the modified pricing information in calculating the cost of the selected items.

1. [Explore] [Probe target web application] The adversary first probes the target web application to find all possible pages that can be visited on the website. 2. [Explore] [Find hidden fields] Once the web application has been traversed, the adversary looks for all hidden HTML fields present in the client-side. 3. [Experiment] [Send modified hidden fields to server-side] Once the adversary has found hidden fields in the client-side, they will modify the values of these hidden fields one by one and then interact with the web application so that this data is sent to the server-side. The adversary observes the response from the server to determine if the values of each hidden field are being validated. 4. [Exploit] [Manipulate hidden fields] Once the adversary has determined which hidden fields are not being validated by the server, they will manipulate them to change the normal behavior of the web application in a way that benefits the adversary.

• The targeted site must contain hidden fields to be modified. • The targeted site must not validate the hidden fields with backend processing.