The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

in order to configure and monitor it?

■

What functions or data resources within the application have you 

identified that would most likely enable you to escalate your current

privileges?

224

Chapter 8 

■

Attacking Access Controls

70779c08v6.5.qxd  9/14/07  3:18 PM  Page 224

---

The easiest and most effective way to test the effectiveness of an applica-

tion’s access controls is to access the application using different accounts, and

determine whether resources and functionality that can be accessed legiti-

mately by one account can be accessed illegitimately by another.

HACK STEPS

■