b0b94c4688
divide by zero, inaccurate discount and totals, reflection of user input git-svn-id: http://webgoat.googlecode.com/svn/trunk/webgoat@273 4033779f-a91e-0410-96ef-6bf7bf53c507
9 lines
570 B
HTML
9 lines
570 B
HTML
<div align="Center">
|
|
<p><b>Lesson Plan Title:</b> How to Hijack a Session</p>
|
|
</div>
|
|
<p><b>Concept / Topic To Teach:</b> </p>
|
|
<!-- Start Instructions -->
|
|
Application developers who develop their own session IDs frequently forget to incorporate the complexity and randomness necessary for security. If the user specific session ID is not complex and random, then the application is highly susceptible to session-based brute force attacks.
|
|
<p><b>General Goal(s):</b> </p>
|
|
Try to access an authenticated session belonging to someone else.
|
|
<!-- Stop Instructions --> |