Which attack allows an attacker to manipulate hidden fields to change data stored in them, such as altering prices during checkout?

Which attack allows an attacker to manipulate hidden fields to change data stored in them, such as altering prices during checkout?

• A. Hidden Field Manipulation
• B. CAPTCHA
• C. Session Fixation Attack
• D. Cookies

Answer: (A)

Hidden fields are parts of a web form intended to carry data through a submission without being shown to the user. Because this data is stored on the client side, it sits under the user’s control. An attacker can modify the value of a hidden field—such as changing a price or quantity—before submitting the form, or intercept and alter the request after the page is loaded. If the server trusts that hidden field value and uses it to complete a transaction, the attacker can manipulate the outcome at checkout. The real protection comes from not trusting anything coming from the client. The server should independently verify critical data, recompute totals from trusted sources (like the product catalog and current pricing rules), and, if necessary, use cryptographic protections (such as signing the hidden data with an HMAC or keeping sensitive data on the server and referencing it via an ID). In short, hidden fields are convenient for passing data, but they must not be trusted for security-sensitive decisions. CAPTCHA is about telling humans from bots, not tampering with form data. A session fixation attack targets the session identifier to hijack a session. Cookies are a client-side storage mechanism and can be manipulated if protections are weak, but this question specifically concerns altering values in hidden form fields to change stored data.

Hidden fields are parts of a web form intended to carry data through a submission without being shown to the user. Because this data is stored on the client side, it sits under the user’s control. An attacker can modify the value of a hidden field—such as changing a price or quantity—before submitting the form, or intercept and alter the request after the page is loaded. If the server trusts that hidden field value and uses it to complete a transaction, the attacker can manipulate the outcome at checkout.

The real protection comes from not trusting anything coming from the client. The server should independently verify critical data, recompute totals from trusted sources (like the product catalog and current pricing rules), and, if necessary, use cryptographic protections (such as signing the hidden data with an HMAC or keeping sensitive data on the server and referencing it via an ID). In short, hidden fields are convenient for passing data, but they must not be trusted for security-sensitive decisions.

CAPTCHA is about telling humans from bots, not tampering with form data. A session fixation attack targets the session identifier to hijack a session. Cookies are a client-side storage mechanism and can be manipulated if protections are weak, but this question specifically concerns altering values in hidden form fields to change stored data.