the-web-application-hackers-handbook

822 Chapter 21 n A Web Application Hacker’s Methodology
6.2 Test with Multiple Accounts
6.2.1 If the application enforces vertical privilege segregation, first use a
powerful account to locate all the functionality it can access. Then
use a less-privileged account and attempt to access each item of this
functionality.
6.2.1.1 Using Burp, browse all the application’s content within one user
context.
6.2.1.2 Review the contents of Burp’s site map to ensure you have
identified all the functionality you want to test. Then, log out
of the application and log back in using a different user context.
Use the context menu to select the “compare site maps” feature
to determine which high-privileged requests may be accessible to
the lower-privileged user. See Chapter 8 for more details on
this technique.
6.2.2 If the application enforces horizontal privilege segregation, perform
the equivalent test using two different accounts at the same privilege
level, attempting to use one account to access data belonging to the
other account. This typically involves replacing an identifier (such as
a document ID) within a request to specify a resource belonging to the
other user.
6.2.3 Perform manual checking of key access control logic.
6.2.3.1 For each user privilege, review resources available to a user.
Attempt to access those resources from an unauthorized user
account by replaying the request using the unauthorized user’s
session token.
6.2.4 When you perform any kind of access control test, be sure to test every step
of multistage functions individually to confirm whether access controls
have been properly implemented at each stage, or whether the application
assumes that users who access a later stage must have passed security
checks implemented at the earlier stages. For example, if an administrative
page containing a form is properly protected, check whether the actual
form submission is also subjected to proper access controls.
6.3 Test with Limited Access
6.3.1 If you do not have prior access to accounts at different privilege levels, or
to multiple accounts with access to different data, testing for broken access
controls is not quite as straightforward. Many common vulnerabilities will
be much harder to locate, because you do not know the names of the URLs,
identifiers, and parameters that are needed to exploit the weaknesses.