![](https://img-blog.csdnimg.cn/20201014180756926.png?x-oss-process=image/resize,m_fixed,h_64,w_64)
4.10 业务逻辑测试
文章平均质量分 84
4.10 业务逻辑测试
开启学习模式
书山有路勤为径,学海无涯苦作舟。学无止境
展开
-
4.10.1-Test_Business_Logic_Data_Validation
The application must ensure that only logically valid data can be entered at the frontend as well as directly to the server-side of an application or system. Only verifying data on the client/frontend may leave applications vulnerable to server injections原创 2023-10-19 09:31:29 · 36 阅读 · 0 评论 -
4.10.10-Test-Payment-Functionality
【代码】4.10.10-Test-Payment-Functionality。原创 2023-10-19 09:30:11 · 36 阅读 · 0 评论 -
4.10.9-Test_Upload_of_Malicious_Files
【代码】4.10.9-Test_Upload_of_Malicious_Files。原创 2023-10-19 09:29:40 · 33 阅读 · 0 评论 -
4.10.8-Test_Upload_of_Unexpected_File_Types
Many applications’ business processes allow for the upload and manipulation of data that is submitted via files. But the business process must check the files and only allow certain “approved” file types. Deciding what files are “approved” is determined by原创 2023-10-19 09:29:09 · 31 阅读 · 0 评论 -
4.10.7-Test_Defenses_Against_Application_Misuse
The misuse and invalid use of valid functionality can identify attacks attempting to enumerate the web application, identify weaknesses, and exploit vulnerabilities. Tests should be undertaken to determine whether there are application-layer defensive mech原创 2023-10-19 09:28:36 · 30 阅读 · 0 评论 -
4.10.6-Testing_for_the_Circumvention_of_Work_Flows
Workflow vulnerabilities involve any type of vulnerability that allows the attacker to misuse an application/system in a way that will allow them to circumvent (not follow) the designed/intended workflow.Definition of a workflow on Wikipedia:The applicatio原创 2023-10-19 09:28:06 · 29 阅读 · 0 评论 -
4.10.5-Test_Number_of_Times_a_Function_Can_Be_Used_Limits
Many of the problems that applications are solving require limits to the number of times a function can be used or action can be executed. Applications must be “smart enough” to not allow the user to exceed their limit on the use of these functions since i原创 2023-10-19 09:27:36 · 28 阅读 · 0 评论 -
4.10.4-Test_for_Process_Timing
It is possible that attackers can gather information on an application by monitoring the time it takes to complete a task or give a response. Additionally, attackers may be able to manipulate and break designed business process flows by simply keeping acti原创 2023-10-19 09:27:02 · 27 阅读 · 0 评论 -
4.10.3-Test_Integrity_Checks
Many applications are designed to display different fields depending on the user or situation by leaving some inputs hidden. However, in many cases it is possible to submit hidden field values to the server using a proxy. In these cases the server-side con原创 2023-10-19 09:26:30 · 36 阅读 · 0 评论 -
4.10.2-Test_Ability_to_Forge_Requests
Forging requests is a method that attackers use to circumvent the frontend GUI application to directly submit information for backend processing. The goal of the attacker is to send HTTP POST/GET requests through an intercepting proxy with data values that原创 2023-10-19 09:25:50 · 24 阅读 · 0 评论 -
4.10.0-Introduction_to_Business_Logic
Testing for business logic flaws in a multi-functional dynamic web application requires thinking in unconventional methods. If an application’s authentication mechanism is developed with the intention of performing steps 1, 2, 3 in that specific order to a原创 2023-10-19 09:24:48 · 31 阅读 · 0 评论 -
4.10 业务逻辑测试
4.10.5 一个函数可以使用的次数限制。4.10.7 测试对应用程序滥用的防御。4.10.8 意外文件类型的测试上传。4.10.1 测试业务逻辑数据验证。4.10.2 测试伪造请求的能力。4.10.6 规避工作流程的测试。4.10.9 测试恶意文件上传。4.10.3 测试完整性检查。4.10.10 测试支付功能。4.10.0 业务逻辑简介。4.10.4 过程定时测试。原创 2023-09-13 21:54:14 · 70 阅读 · 0 评论