the-web-application-hackers-handbook

CHAPTER
8
Attacking Access Controls
Within the application’s core security mechanisms, access controls are logically
built on authentication and session management. So far, you have seen how an
application can first verify a user’s identity and then confirm that a particular
sequence of requests that it receives originated from the same user. The primary
reason that the application needs to do these things — in terms of security, at
least — is because it needs a way to decide whether it should permit a given
request to perform its attempted action or access the resources it is requesting.
Access controls are a critical defense mechanism within the application because
they are responsible for making these key decisions. When they are defective, an
attacker can often compromise the entire application, taking control of administrative
functionality and accessing sensitive data belonging to every other user.
As noted in Chapter 1, broken access controls are among the most commonly
encountered categories of web application vulnerability, affecting a massive 71
percent of the applications recently tested by the authors. It is extremely common
to encounter applications that go to all the trouble of implementing robust
mechanisms for authentication and session management, only to squander that
investment by neglecting to build effective access controls on them. One reason
that these weaknesses are so prevalent is that access control checks need to be
performed for every request and every operation on a resource that particular
user attempts to perform, at a specific time. And unlike many other classes of
control, this is a design decision that needs to be made by a human; it cannot
be resolved by employing technology.
257