ACCESS CONTROL VULNERABILITIES: Solving Portswigger web securities Labs 4–6.

Access control is the application of constraints on who or what is authorized to perform actions or access resources. In the context of web applications, access control is dependent on authentication and session management:

• Authentication confirms that the user is who they say they are.
• Session management identifies which subsequent HTTP requests are being made by that same user.
• Access control determines whether the user is allowed to carry out the action that they are attempting to perform.

There are three types of acess control namely; Vertical access controls Vertical access controls are mechanisms that restrict access to sensitive functionality to specific types of users. Horizontal access controls Horizontal access controls are mechanisms that restrict access to resources to specific users. Context-dependent access controls Context-dependent access controls restrict access to functionality and resources based upon the state of the application or the user’s interaction with it.

An Access control vulnerability occurs when a application or system fails to properly enforce restrictions on what users can see or do. While authentication verifies who you are, access control (authorization) determines what permissions you have.

When these controls fail, unauthorized users gain access to sensitive data, administrative features, or other users’ accounts. Broken access control consistently ranks as the #1 threat on the OWASP Top 10.

Lab: User role can be modified in user profile

This lab has an admin panel at /admin. It's only accessible to logged-in users with a roleid of 2. Solve the lab by accessing the admin panel and using it to delete the user carlos. You can log in to your own account using the following credentials: wiener:peter

`**STEPS

• `**Log in using the supplied credentials and access your account page.
• Use the provided feature to update the email address associated with your account.
• Observe that the response contains your role ID.
• Send the email submission request to Burp Repeater, add "roleid":2 into the JSON in the request body, and resend it.
• Observe that the response shows your roleid has changed to 2.
• Browse to /admin and delete carlos.

Lab: User ID controlled by request parameter

• This lab has a horizontal privilege escalation vulnerability on the user account page.
• To solve the lab, obtain the API key for the user carlos and submit it as the solution.
• You can log in to your own account using the following credentials: wiener:peter.

**STEPS

• **Log in using the supplied credentials and go to your account page.
• Note that the URL contains your username in the “id” parameter.
• Send the request to Burp Repeater.
• Change the “id” parameter to carlos.
• Retrieve and submit the API key for carlos.

Lab: User ID controlled by request parameter, with unpredictable user IDs

This lab has a horizontal privilege escalation vulnerability on the user account page, but identifies users with GUIDs. To solve the lab, find the GUID for carlos, then submit his API key as the solution. You can log in to your own account using the following credentials: wiener:peter. **STEPS

• **Find a blog post by carlos.
• Click on carlos and observe that the URL contains his user ID. Make a note of this ID.
• Log in using the supplied credentials and access your account page.
• Change the “id” parameter to the saved user ID.
• Retrieve and submit the API key.