Break an application with input it did not expect

short · 40 min · Objective 4.1

Task

Write a small application with no input validation, feed it input its author did not anticipate, then fix it on the server side and confirm the same input is now rejected. Client-side validation is a usability feature, and this lab shows why.

Steps

  1. Write /tmp/app.py: a tiny HTTP service taking an amount parameter and a name, which it echoes into a response and uses in a calculation. Add CLIENT-side validation only — an HTML form with maxlength and type=number.
  2. Use the form in a browser and confirm the validation appears to work.
  3. Now bypass the client entirely with curl, sending a negative amount, a non-numeric amount, an amount of extreme length, and a name containing markup.
  4. Record what happened for each: a crash, a wrong calculation, the markup reflected into the response.
  5. Add server-side validation: allow-list the acceptable shape of each input, and encode output rather than echoing it.
  6. Re-run the same four requests and confirm each is now rejected cleanly with a sensible status rather than a stack trace. Write both result sets into /tmp/validation.md.

Verify

curl -s -o /dev/null -w "%{http_code}\n" "http://127.0.0.1:8090/?amount=-5&name=x"
curl -s -o /dev/null -w "%{http_code}\n" "http://127.0.0.1:8090/?amount=abc&name=x"
curl -s "http://127.0.0.1:8090/?amount=1&name=%3Cb%3Ehi%3C%2Fb%3E" | grep -c "<b>hi</b>"
python3 - <<'PY'
import urllib.request,urllib.error
def code(q):
    try:
        urllib.request.urlopen('http://127.0.0.1:8090/?'+q); return 200
    except urllib.error.HTTPError as e: return e.code
bad=[code('amount=-5&name=x'),code('amount=abc&name=x'),code('amount='+'9'*5000+'&name=x')]
print('status codes for bad input:',bad)
assert all(c>=400 for c in bad), 'the server accepted input it should reject'
print('all invalid input rejected server-side')
PY

The third command must be 0: the markup must come back encoded rather than as live tags. The assertion requires every malformed request to be refused with a 4xx — if any returns 200, the validation is still only in the browser, which is under the caller's control and therefore not a control at all.

Notes

Note that curl never loaded your form. That is the entire argument: client- side validation improves the experience of people using the interface you provided, and an attacker is not using the interface you provided.

This is an independent study companion for CompTIA Security+ SY0-701 and is not produced by or endorsed by CompTIA.