the-web-application-hackers-handbook

Chapter 8 n Attacking Access Controls 269
Figure 8-1: A site map comparison showing the differences between content that
was accessed in different user contexts
Figure 8-2 shows the response returned when each user requests the top-level
admin page. Here, the administrative user sees a menu of available options, while
the ordinary user sees a “not authorized” message. These differences indicate
that access controls are being applied correctly. Figure 8-3 shows the response
returned when each user requests the “list users” admin function. Here, the
responses are identical, indicating that the application is vulnerable, since the
ordinary user should not have access to this function and does not have any
link to it in his or her user interface.
Simply exploring the site map tree and looking at the number of differences
between items is insufficient to evaluate the effectiveness of the application’s
access controls. Two identical responses may indicate a vulnerability (for example,
in an administrative function that discloses sensitive information) or may be
harmless (for example, in an unprotected search function). Conversely, two different
responses may still mean that a vulnerability exists (for example, in an
administrative function that returns different content each time it is accessed)
or may be harmless (for example, in a page showing profile information about
the currently logged-in user). For these reasons, fully automated tools generally
are ineffective at identifying access control vulnerabilities. Using Burp’s
functionality to compare site maps, you can automate as much of the process
as possible, giving you all the information you need in a ready form, and letting
you apply your knowledge of the application’s functionality to identify any
actual vulnerabilities.