Logic Flaw Demos
1. Password Change FormYou are logged in as wally
Goal: Change 'admin' password
SolutionRemove oldpass parameter entirely to become admin.
2. Filtered Ping Form
Goal: perform 'ls'
google.com;ls google.com|ls google.com&ls google.com\ls google.com;;ls google.com\;ls
3. Multiple Stages
Goal: purchase product with invalid credit card
SolutionGo as far as you can through the shopping process.
Note the URLs and find the pattern.
Manually proceed to last step. Deduce URL from pattern , insert address in URL query string.
4. Electric Shoe (10 pts. extra credit)Shoe Administration Page
Goal: put your name on the shoe
5. Double Quotes
Reset the Database Before Using it
Goal: display all names