Q K Session Session Salim can bypass session Peter can bypass the session (no card) (no card) management because it is not management controls because applied comprehensively and they have been self-built and/or Management Management consistently across the are weak, instead of using a application standard framework or approved tested module A 2 3 Authorization Authorization Authorization Authorization You have invented a new attack (no card) Tim can influence where data is Christian can access (read, write, against Authorization sent or forwarded to update or delete) information, which they should not have permission to, through another mechanism that does have permission (e.g. search indexer, logger, reporting), or because it is cached, or other information leakage
Session Management Q Session Management K Salim can bypass session management because it is not applied comprehensively and consistently across the application Peter can bypass the session management controls because they have been self-built and/or are weak, instead of using a standard framework or approved tested module (no card) (no card) Authorization A Authorization Authorization 2 Authorization 3 You have invented a new attack against Authorization (no card) Tim can influence where data is sent or forwarded to Christian can access (read, write, update or delete) information, which they should not have permission to, through another mechanism that does have permission (e.g. search indexer, logger, reporting), or because it is cached, or other information leakage
20130918180557%21OWASP-Cornucopia-Ecommerce_Website.docx