the-web-application-hackers-handbook

266 Chapter 8 n Attacking Access Controls
This type of access control may sometimes be difficult to detect without
actually using the application as a high-privileged user and identifying what
requests are made. The techniques described in Chapter 4 for discovering hidden
request parameters may be successful in discovering the mechanism when
working only as an ordinary user.
Referer-Based Access Control
In other unsafe access control models, the application uses the HTTP Referer
header as the basis for making access control decisions. For example, an application
may strictly control access to the main administrative menu based on
a user’s privileges. But when a user makes a request for an individual administrative
function, the application may simply check whether this request was
referred from the administrative menu page. It might assume that the user must
have accessed that page and therefore has the required privileges. This model
is fundamentally broken, of course, because the Referer header is completely
under the user’s control and can be set to any value.
Location-Based Access Control
Many businesses have a regulatory or business requirement to restrict access to
resources depending on the user’s geographic location. These are not limited
to the financial sector but include news services and others. In these situations,
a company may employ various methods to locate the user, the most common
of which is geolocation of the user’s current IP address.
Location-based access controls are relatively easy for an attacker to circumvent.
Here are some common methods of bypassing them:
n Using a web proxy that is based in the required location
n Using a VPN that terminates in the required location
n Using a mobile device that supports data roaming
n Direct manipulation of client-side mechanisms for geolocation
Attacking Access Controls
Before starting to probe the application to detect any actual access control
vulnerabilities, you should take a moment to review the results of your application
mapping exercises (see Chapter 4). You need to understand what the
application’s actual requirements are in terms of access control, and therefore
where it will probably be most fruitful to focus your attention.