in the last lecture we had an example of a broken access control bug or
vulnerability that allowed us to literally gain access
to the admin panel by modifying the cookies
but as mentioned earlier,
broken access control is a term that covers a large number of vulnerabilities.
Any vulnerability that allows us to access or modify data that does
not belong to us is considered a broken access control vulnerability.
So another really good way of testing these kind of vulnerabilities
is to create two accounts on the target website.
Have different information for these accounts.
So I have different names, different emails and different addresses.
For example whatever information it asks for just submit different information.
And then we're gonna log in as one of these accounts
and see while I'm logged in as James bond for example can I
access the name of a different account or their email or their address
if I can.
And if the website is designed to not
share this information for example some blog websites
do share on purpose the names of their authors.
But let's say for example if I'm able to
access their email or their address from another account,
then that means I am able to access information that does not belong to me.
And therefore it means that I discovered
a broken access control vulnerability or bug.
Let me show you this in a nice example.
I'm going to share its link in the resources and
as usually want to test everything within the website.
And once done we're going to create two accounts and like I said,
we do this for two purposes.
First is that you'll be able to test more
functionalities such as comments and reviews and so on.
And second you'll be able to test for broken access control.
Now because this is a test website similar to the previous one,
you can't create accounts but you can log in with the following credentials.
So we're going to copy
and paste it in here to log in
and perfect now that I'm logged in,
you can see that it's giving me my user name
and a certain api key which belongs to me only.
And I also have an extra feature to update my email.
Like I said, this is very useful usually when you log in,
you get more features to test on the target website.
So therefore you'd want to go home and start looking for new features that are
only available to you as a user and test them for bugs and vulnerabilities.
Now, if you view a post in here,
you can see we have a user called Carlos.
Now, if I click on Carlos,
it's going to give me the blog posts written by him. And if you look closely to the U. R.
L. In here, you'll see that we have his user I. D.
If you see this in a target website, you should make a note of it.
I'm going to copy it.
However, because I know this is going to be useful and if you go back to your account
you'll notice that on the top you're accessing a
path or an endpoint that is called my account.
And you're passing a value of an I. D. To it. This I. D. Is probably your own I. D.
And it's different from Carlos I. D. That we just copied.
So let's see what happens if we paste the idea of Carlos
we had entered.
And perfect right now it's telling us that our user name is Carlos and
our api key is this so we're able to access Carlos api key.
So because we're able to access information that belong to another user
that means we discovered a broken access control bug or vulnerability.
This is a valid bug that you should submit. If you're hunting for bugs
and you should definitely include it in your report. If your pen testing.
Now depending on your target, you might not be able to guess this I. D.
Or get it from a blog post.
Therefore it is really useful to follow
this methodology where you create two accounts.
And then because this account belongs to you, you know it's I. D.
And you can log in from this account and try to access
the data that belongs to this account using this guy's I.
D.
Another way of doing this is to simply guess it.
So there is another example in here. I'm going to share it in the resources as usual.
And in this example let's log in first
same user name and password.
And this time there is nowhere for you in the
home directory to find other users on the same page.
Therefore you'll either have to create another user yourself and see if you can
access its information or you're going to have to guess another user name.
So this time in the account I. D. You're actually not getting an I. D.
You're getting an actual user name.
So a really good user name to guess is admin for example.
And that looks like it doesn't work because it brought us back to the login page.
So maybe we should try administrator
and perfect as you can see that worked
and it's also showing us the password this time.
Now this password appears like it's actually hashed.
But you can very easily see it by inspecting the
code that is responsible for rendering this part of the page
regardless of the language that the target application
is written in at the back end site,
whether it's written in python, java, ruby, it really doesn't matter.
At the end of the day,
everything will have to be rendered as html because browsers
can only interpret html and javascript so everything will have to
be rendered in a text based format that the browser
is able to understand and show you here as elements.
Therefore you can right click any element that you see on the page
and click on inspect
to see the html code
that is responsible for rendering this element.
So as you can see if I highlight
the password in here, it gets highlighted on the top.
If I highlight the label for the password, it gets highlighted on the top.
If I highlight the input box for the password in here,
it's getting highlighted on the top because this is the html code
that is responsible for rendering this element for displaying this element
and you can see in here
we actually have a value parameter
that is specifying the password. So this is actually the password in plain text.
So even though it seems like the password is invisible in here,
you can easily see it in here by inspecting the element
and now you can simply copy this and then go to the admin page.
So we're going to log out,
go to the admin page.
I'm assuming there is an admin page
and actually just log in with the user name,
administrator and the password that I just copied.
I'm going to close this and log in
and perfect as you can see now we are logged in as admin,
we can go to the admin panel and delete users
or use any functionality that is only available to the admin