The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

administrator is found. However, when accounts are identified by a sequential

numeric ID, it is very common to find that the lowest account numbers are

assigned to administrators. Logging in as the first few users who were

registered with the application will often identify an administrator. If this

approach fails, an effective method is to find a function within the application

where access is properly segregated horizontally — for example, the main home

page presented to each user. Write a script to log in using each set of captured

credentials, and then try to access your own home page. It is likely that

administrative users are able to view the home page of every user, so you will

immediately detect when an administrative account is being used.

Chapter 8 

■

Attacking Access Controls  227

70779c08v6.5.qxd  9/14/07  3:18 PM  Page 227

---

In every instance where an application superficially appears to be enforcing

access controls effectively, you should probe further to determine whether any

defective assumptions have been made by developers.

HACK STEPS

■