the-web-application-hackers-handbook

272 Chapter 8 n Attacking Access Controls
HACK STEPS
(CONTINUED)
3. One way to perform this testing manually is to walk through a protected
multistage process several times in your browser and use your proxy to
switch the session token supplied in different requests to that of a
less-privileged user.
4. You can often dramatically speed up this process by using the “request in
browser” feature of Burp Suite:
a. Use the higher-privileged account to walk through the entire multistage
process.
b. Log in to the application using the lower-privileged account (or none
at all).
c. In the Burp Proxy history, find the sequence of requests that were
made when the multistage process was performed as a more privileged
user. For each request in the sequence, select the context menu
item “request in browser in current browser session,” as shown in
Figure 8-4. Paste the provided URL into your browser that is logged in
as the lower-privileged user.
d. If the application lets you, follow through the remainder of the
multi-stage process in the normal way, using your browser.
e. View the result within both the browser and the proxy history to
determine whether it successfully performed the privileged action.
Figure 8-4: Using Burp to request a given item within the current browser session