Access control vulnerabilities and privilege escalation

• Lý thuyết về Access Control

• Lý thuyết về Insecure direct object references

• [Các bài lab về Broken Access control theo chủ đề]:

  • Unprotected functionality

  • Unprotected functionality with unpredictable URL

  • User role controlled by request parameter

  • User role controlled by hidden request parameter but leaked in response

  • Broken access control resulting from non-standard HTTP headers (X-Original-URL, X-Rewrite-URL)

  • Broken access control by alternate HTTP request methods when performing an action

  • Horizontal privilege escalation: User ID controlled by request parameter, User ID controlled by request parameter, with unpredictable user IDs, User ID controlled by request parameter with data leakage in redirect.

  • Horizontal to vertical privilege escalation: User ID controlled by request parameter with password disclosure

  • Multi-step process with no access control on one step

  • Referer-based access control

  • Insecure direct object references

• Sử dụng extension Autorize và AutoRepeater của Burp Suite để tự động test các lỗi Broken Access Control

• Hướng dẫn cài Autorize và AutoRepeater