Analyze web application logs to identify business logic flaws. In this scenario, you will investigate how an attacker manipulated client-side data to bypass pricing controls.
You are a SOC Analyst investigating an alert generated by the fraud department of BuyOnline Inc. The finance team noticed an order was successfully fulfilled for a premium product, but the credit card was only charged $10 instead of the $100 MSRP. There are no signs of SQL injection or cross-site scripting in the WAF (Web Application Firewall) logs.
Your task is to review the SIEM web access logs to determine the exact attack vector used to bypass the payment logic.
An attacker exploits the logic validation mechanisms of an e-commerce website. He successfully purchases a product worth $100 for $10 by modifying the URL exchanged between the client and the server.
Original URL: http://www.buyonline.com/product.aspx?profile=12&debit=100
Modified URL: http://www.buyonline.com/product.aspx?profile=12&debit=10
Identify the attack depicted in the above scenario.
We are observing a severe Business Logic Flaw. The application is trusting client-side input to dictate the price of an item. The attacker intercepted the HTTP GET request (likely using a tool like Burp Suite or simply editing the address bar) and changed the query string parameter debit=100 to debit=10. Because the backend server did not cross-reference this value with a trusted database before processing the payment, the transaction succeeded at the tampered price.
Modifying data in the URI query string, POST body, or HTTP headers to subvert application logic is the textbook definition of Parameter Tampering (also known as Web Parameter Tampering). The attacker literally "tampered" with the "parameter" (debit).
A. Denial-of-Service: Aims to disrupt availability by overwhelming resources, not alter application logic for financial gain.
B. SQL Injection: Involves inserting malicious SQL statements into input fields (e.g., ?profile=12' OR 1=1--). Changing a number to a different valid number is not SQLi.
D. Session Fixation: Involves an attacker forcing a known, valid session ID onto a victim's browser to hijack their authenticated session. It has nothing to do with modifying product pricing.
Traditional WAFs (Web Application Firewalls) often miss Parameter Tampering because they look for signatures like <script> or UNION SELECT. A change from 100 to 10 looks perfectly benign to a signature-based WAF. SOC Analysts must rely on specialized alerts (like "price discrepancy detected" from fraud systems) or implement Positive Security Models in the WAF, which strictly define the allowable schema and values for specific parameters.
The root cause of Parameter Tampering is violating the rule of "Never Trust User Input."
ProductID. The server looks up the price in its own secure backend database and calculates the total internally, ignoring any price data sent by the client.Practice more realistic scenarios to prepare for your EC-Council CSA exam.
Explore more CSA simulations