The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

Attacking Access Controls 

Before starting to probe the application to detect any actual access control vul-

nerabilities, you should take a moment to review the results of your applica-

tion mapping exercises (see Chapter 4), to understand what the application’s

actual requirements are in terms of access control, and therefore where it will

probably be most fruitful to focus your attention.

HACK STEPS

Questions to consider when examining an application’s access controls include:

■

Do application functions give individual users access to a particular sub-

set of data that belongs to them?

■

Are there different levels of user, such as managers, supervisors, guests,

and so on, who are granted access to different functions? 

■

Do administrators use functionality that is built into the same application