Vulnerability Discovery: Booking Zero Dollar Travel Via a Site - Seguridad Mania.com - España y América Latina

This presentation will demonstrate the value of manual business logic assessments and provide an example of an abuse of functionality vulnerability identified on a travel booking website. The speaker will provide a real life instance that allowed a user to book zero dollar or negative values for reservations for hotel rooms, entertainment, and restaurants. He will also cover best practices on how to protect your website against abuse of functionality vulnerabilities. The speaker will cover the business impact of the Abuse of Functionality vulnerability including: - How users were being given full control over the amount they paid for events. - Resulting event costs - How this vulnerability created a significant loss for the business