Bypassing Client-Side Controls
Bypassing Client-Side Controls
Hidden Form Fields in HTML code.
HTTP Cookies: Look set-cookie parameters of response,and find out something is interesting or not like(UID,SesssionID,DiscountPrice);
URL parameters pollution
referrer Header: from where the current req is originated , looks any tokens are leaked
Opaque data: encrypted data params, look the all params when you create new acc. maybe some params leak in other functionality of the application so collect all parameters or track all params. obfuscation algorithm
The ASP.NET ViewState:
HTML forms: look input filed attributes and hidden input fields, disable elements
script-based validation
Last updated