The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

Information page displays a user’s personal details together with his

username and password. While the password is typically masked on-screen,

it is nevertheless transmitted in full to the browser. Here, you can often

quickly iterate through the full range of account identifiers to harvest the

login credentials of all users, including administrators. The following example

shows Burp Intruder being used to carry out a successful attack of this kind.

T I P

When you have detected an access control vulnerability, an immediate

attack to follow up with is to attempt to escalate your privileges further by

compromising a user account with administrative privileges. There are various

tricks you can use in trying to locate an administrative account. Using an 

access control flaw like the one illustrated, you may harvest hundreds of user

credentials and not relish the task of logging in manually as every user until an