Welcome to Broken access control session.
In this first part, we will focus on threads analysis.
We will take our time to dig into Access Control, floods details. And
then we will discuss how the system can be harmed. Then
back, talk, successful exploitation and give you
some insights to identify who may want to harm your system.
Authentication and access control are often combined in
a single operation. Causing a serious. Misunderstanding regarding
controls boundaries. We have already discussed
authentication. Flaws in this session. We
will just focus authorization, whereby the system
makes a decision to Grant a reject access to requested resources
from an already authenticated user based
on what the user is, authorized to do Anonymous.
Users are also subject of Access Control. Although
the system is not able to check their
The authorization checks should be performed just like
for any other user or user will.
To make sure that there is no doubt, authorization and
authentication are two different things.
There are several Access Control models, but role-based
access control is the most common one in web applications since
IT addresses, most commercial and government. Organizations
needs role-based. Access control
is defined around roles such as Anonymous user, customer
or admin and privileges or what
they can do read, write update or delete some
resource or execute some function. This may
sound simple, but it tends to become complex. When we start adding
Rosie are our key or fine-grained. Privileges.
Better than showing complex, data flow diagrams. We
will exploit different authorities ation issues in our intentionally vulnerable
application.
Access Control mechanisms of old applications left
running and public accessible tend to be broken
or outdated, does easier to exploit some
applications rely on obscurity to hide an assertive and
points from regular users. Assuming that only
admins know the others, some guesswork and
available word lists and automatic tools are enough to uncover
such endpoints.
Parameter pollution is a technique that may allow attackers to
bypass Access Control mechanisms. Just by playing around with
URL query string parameters, cookies or request body.
Some business logic requires actions to be performed
in a certain order since HTTP is stateless.
Then it is up to the backend to track whether those
actions are performed in the required order, messing
with actions order matric, the access control mechanism.
Accessing other users data May expose sensitive
data such as Pi and financial or health records.
Compromising admin level functions may
expose all user data.
If privilege levels, do not distinguish users who
can only view data in those who can modify, it then
attackers may be able to modify other users data, creating
some sort of inconsistency or severe data loss.
Sometimes attackers managed to execute actions as
other users or even higher level functions. If
the system fails to distinguish malicious activity,
from legit one, then attackers will be able to
perpetrate all sort of fraud.
As with several other flaws, we have already discussed Access
Control. One's not, only allow attackers to access data, but
also execute actions on user's behalf. Just
considering the confidential or sensitive data, exposure issue.
You should think about who individuals or
organizations May benefit from accessing your users
data nation-state competitors or
activists may be among them.
The ability to execute actions on user's behalf is
attractive to fraudsters, depending on
what administrative functionalities your system has malicious actors
may be able to eject the whole system or take advantage
of it to perpetrate other attacks against other
systems of yours or even third party ones.
You'll find this table in the last top 10. Pause the
video and take your time to carefully, read it.
In the next part, we will exploit several Access Control flaws in
order to access some sensitive data and execute administrative functions.