OWASP Security Shepherd Project - Poor Data Validation Lesson

What is Poor Data Validation Vulnerability/Threat?

    Poor Data Validation happens when an application does not check the input data submitted by user/connection. Poor Data Validation maybe low severity, but they usually lead to other high severity security risks. Attackers can take advantage of poor data validation to perform business logic attacks or cause server errors.
     When an application received input data, it should always not trust the data and examine that it has correct syntax, is within length boundaries, contains only permitted characters and within range boundaries. Ideally, data validation process should be performed on both client side and again on the server side.

Lesson

    In this lesson, our task is to successfully input a negative number.

     Let's try to input -1 directly.

Here is a data validation process to check if the number is greater than 0.

    Let's see what happens in BurpSuite(or any other proxy like ZAP). You will notice that nothing happens in the BurpSuite, but the application still shows the same error message as above. As a result, we know the validation is on client side.
    Now, it is time to check if this validation works in server side as well. We input 1 in application and capture the request with BurpSuite. You will notice that the number we input is actually shows in userdata field. We modify it manually from 1 to -1.



Let's forward this request =>

Great! This completes the lesson.