so far all of the broken access control vulnerabilities or bugs that we covered
allowed us to access information or data beyond our limits.
But as you can see in this definition we said broken
access control can allow us to access or modify information.
So in this lecture I'm going to show you an example of a broken
access control vulnerability where we're gonna be
able to modify information beyond our limits.
And as we do that I'm gonna introduce you to the repeater functionality of Burp suite
so that you can use it in any other situation where you need such functionality.
So I have the target website in here as usually want to test everything and the
link is in the resources and this website
is pretty similar to everything we've been testing
and usually once we log in with the user name winner and the password peter as usual
we get this input box that allow us to change or update our email
but I never actually tested this. So as we mentioned.
And as I'm going to show you later on when I get to my hacking methodology,
you're gonna have to press every button and test
every single functionality offered by the target website.
So let's go ahead and test it normally as a normal user assuming
we want to change our email and to do so we're just gonna type
test at test dot com just for example we want to change our
email to that our current email is this And if I collect an update
as you can see. Perfect.
My user name is still the same but my email changed to test at test dot com.
Now this is an input box.
And as mentioned before, input boxes can be used to send data to the web application.
And a great example is this one right here because
once we typed our email test at test dot com,
this email was sent to the web application.
And based on this input, the web application executed code
to change our email to the email that we inputted in the input box.
And therefore we can use this box to manipulate the behavior of
the web application and possibly discover box in it and exploit them.
So every single book that you're gonna learn later on in the course,
you should try to test for it in this input box.
But right now we are talking about broken access control.
So let's try to understand how this works,
analyze it and see if we can discover any bugs in it.
And a great way of doing this is using the repeater functionality of Burp suite.
So we're familiar with the proxy and right now I'm already in the proxy window,
I'm gonna turn the proxy on and I'm gonna put another email.
So let's say test to at test dot com
and we're going to click on update the email.
We're gonna intercept the request in here.
And as you can see it's a post request.
It's being sent to this path right here.
And if we look down in the body parameters we can see a value of an email
and the value is what we inputted in this input box.
So you can test for all of the vulnerabilities that you will learn later
on and everything that you learned so far by inputting data in this box,
click and update, intercepting it in here and modifying this value in here.
Or you can actually right click this request and click on send to repeater.
Once you do that you'll see now the repeater is highlighted in orange
and if I click on the repeater
I have the exact same request that we had before.
And if we scroll down we have the same values that we inputted in here.
You can click on the inspector similar to what we had in the proxy to
browse and edit this data based on the categories that you have in here.
And once you click on sand
this request is going to be sent and you'll
be able to see the response that this request triggered
right here at the bottom.
Therefore you can modify this request as you
wish right here or you can use the inspector
in here and modify it similar to what we did when we were using the proxy.
But the nice thing is once you modify this request you
can click consent and you'll instantly see the response in here.
So you won't have to always submit the data using the target website
intercepted in the proxy and then edit it and then forward it.
You can use the repeater to quickly test for a large
number of vulnerabilities because as we go through the course,
I'm going to teach you so many different vulnerabilities.
And every time you see data being sent to the target such as this
data right here or if it's being sent in the request parameters in here,
you want to modify this data and test for all of these vulnerabilities.
So with the repeater you can do this pretty quickly and analyze the response.
Another benefit of using the repeater is that sometimes when you load
the website or when you click on update or submit a form,
a number of requests are sent.
So you'd want to test every single request and therefore you can split them,
send them to the repeater.
Like so analyze the results and see if
you can use it to discover any vulnerabilities.
Now once we send a post request to this path
and the value of the request is a new email we
get a response of 300 which is a redirection response.
If you remember when we spoke about the responses earlier
and we're being redirected to my account to the account page
and the result you can see the user name which we can actually see on our user name.
You can see the new email that we requested in our request.
You can see the api key but this is our api key. So this is not really
an information leak or an information disclosure.
And you can also see the role I. D.
So this is probably my permissions on this website or my role on this website.
Now again this is another example where the
hacker or bug hunter mentality comes into play.
It's very important to pause when you see information like this and just go back
to the website and think what does this form allow the user to do?
And the answer is very simple. It allows the user to update their email.
Now what is the email? The email is part of the user information.
So this form
allows the user to update their user information and we can
see once we submit the new information which is the new email
we get a response with all of the user information including the
email which is the specific information that we wanted to modify.
So let's try to use the same form and the same request
to update another piece of information.
And for example let's try to change the role I. D. To a different role I. D.
We're gonna copy what we have in here
and we're going to use the same format.
So we're gonna put a coma in our request a new line
and we're gonna paste what we copied
and our character all idea is one as you can see in here.
Therefore we're going to set it to two
we're going to click on send to send it.
And as you can see in the response we're not getting
a 400. We're not getting anything that is given us an error.
We're actually getting a 300 meaning a redirect
to the my account with the new information.
So the email is still the same because we actually didn't modify the email.
But now my role I. D. has changed too.
So that's perfect.
That means I managed to modify my user information in here and change my role I. D.
Even though this form is not designed to allow me to change that
now let's go ahead to my proxy and turn off the interceptor
and let's refresh this page.
And as you can see now I actually have access to the
admin panel because I changed my privileges to a higher privileged user.
So I changed my role idea to number two.
And it looks like in this web application role I. D.
Number two gives you admin privileges. So again this is not concrete.
This is not always the way but you want to look at your
target web application and manipulate its values based on what you see.
So we saw that we have roll I. D.
Number one and usually I would actually try to set that to
zero first and if that didn't work I would try to 34.
If I saw I I would call it be if I saw a normal user I will try to change my role I. D.
To admin.
So you want to see how the web application is working and
modify it within the same constraints or within the same methodology.
So let's click on the admin panel and see if this actually works.
And as you can see we managed to get access to the admin page.
So this is obviously an example of broken access control.
Now you don't necessarily have to use the repeater to do this.
But I wanted to introduce you to it because it is very useful and
we will be using it in the future when we're testing for vulnerabilities.
When you want to run a number of tests,
you want to be able to modify the requests quickly and study the response
to see if that would help you to discover other bugs and vulnerabilities.