Hi and welcome back to Section 8
web application attacks.
During this video, you will learn how to perform broken authentication
attack on a vulnerable web application.
I hope you excited. So let's dive on
in.
Broken Access Control simply allows either authenticated
or on authenticated users
to perform actions on a web application or a
system that are not usually permitted.
Simply by implementing access controls on a system
and let's say even on a web application simply helps
administrators to your strict
access to sensitive and confidential directories uneven
private data from unauthorized persons.
However, while many organizations will Implement a
pre-built web application framework on
the web server many pre-built or
ready to use web application Frameworks usually
contains default security configurations. And
if these web applications are
installed with all using best practices thread
actors at golakers penetration testers
can simply keen on authorized access
by exploiting the Broken Access Control
mechanisms found in these web apps
On the homepage for the oras shoe shop.
We can simply add extensions to the URL
and see whether we are able to actually access any
sort of hidden directories that may be restricted.
for instance, we can simply type Administration
like so
With a slash let's hit enter.
And look we are solve the challenge and this speed
supposed to be a restricted Peach from everyone.
Since you have again access to restricted administrative
section within a web application, we can
even delete custom of feedback
as you can see there are various customers who left
feedback.
on reviews
if you don't like a review we can simply delete these reviews
if you choose.
During this video you have learned how to discover and exploit
broken authentication on a vulnerable web application in
the next video. We will take a photo
look into discovering authentication failures
on web applications. I hope
this video has been a formative for you and I will see
you in the next one.