-
Book Overview & Buying
-
Table Of Contents
-
Feedback & Rating

Burp Suite Cookbook
By :

Account provisioning is the process of establishing and maintaining user accounts within an application. Provisioning capabilities are usually restricted to administrator accounts. Penetration testers must validate that account-provisioning functions are only available to users with proper identification and authorization. A common venue for account provisioning is through REST API calls. Many times, developers may not put the same authorization checks in place for API calls that are used in the UI portion of an application.
Using REST API calls available in the OWASP Mutillidae II application, determine whether any unauthenticated API calls exist and whether such calls can provision or modify users.
Make sure you are not logged in to the application. If you are, click the Logout button from the top menu. Now, follow these steps:
Change the font size
Change margin width
Change background colour