top of page

Cybersecurity / IT

Untitled design (3).jpg

Identifying and Exploiting Broken Access Control (OWASP A01:2021)

In this lab, I explored one of the most critical vulnerabilities listed in the OWASP Top 10: Broken Access Control. The objective was to simulate unauthorized access to restricted functionality or data by manipulating client-side controls, insecure direct object references (IDOR), and URL tampering. This hands-on exercise enhanced my understanding of web application access layers and the consequences of improper enforcement.

Introduction

The core of the project consisted of the following components:

  • Platform: OWASP Juice Shop (v13.x)

  • Tools:

    • Burp Suite Community Edition – For intercepting and modifying HTTP requests

    • Google Chrome DevTools – For inspecting DOM and client-side logic

    • Kali Linux VM – Base operating system for lab execution

    • Postman – For sending crafted API requests

    • OWASP Top 10 Guidelines – Reference for attack methodology and remediation

Lab Environment and Tools Used

  • Understand and exploit common access control vulnerabilities listed under OWASP A01:2021.

​

  • Demonstrate how improper enforcement of user permissions can lead to unauthorized data exposure or functionality abuse.

​

  • Practice using tools like Burp Suite and Postman to intercept and manipulate HTTP requests.

Lab Objective

🔹Step 1: Setup and Enumeration

  • Launched OWASP Juice Shop on localhost:3000.
     

  • Registered two user accounts:

  • Logged in as user1, and browsed the account settings and network requests.

Steps and Technical Walkthrough

🔹 Step 2: Identifying Insecure Object References

  • Accessed the order history page.
     

  • Intercepted the HTTP request via Burp Suite:

    GET /rest/user/order/12345 HTTP/1.1
    Authorization: Bearer eyJhbGciOi...

​

  • Changed the order ID to 12344 and replayed the request.
     

  • Successfully retrieved order data for another user—confirming an Insecure Direct Object Reference (IDOR) vulnerability.

Steps and Technical Walkthrough

🔹 Step 3: Privilege Escalation via Role Manipulation

  • While logged in as user1, intercepted a profile update request:
     

    {
      "username": "user1",
      "role": "admin"
    }
     

  • Manually modified the role field and sent the request.
     

  • Received a 200 OK response and was redirected to the admin dashboard.
     

  • Demonstrated a Broken Access Control issue due to lack of server-side role validation.

Steps and Technical Walkthrough

🔹 Step 4: Client-Side Tampering

  • Using Chrome DevTools, uncovered hidden admin UI elements (buttons/menus) that were simply hidden with CSS (e.g., display: none).
     

  • Removed the CSS restriction and clicked an admin-only function, which succeeded due to lack of proper server-side authorization checks.

Steps and Technical Walkthrough

Untitled.jpg

Findings and Observations

  • Access control must be enforced on the server side; relying on client-side controls is ineffective and dangerous.

​

  • Insecure Direct Object References remain prevalent in many applications that expose sequential IDs or predictable patterns.

​

  • Web application roles and privileges must be validated at each endpoint, not just during login.

​

  • Tools like Burp Suite and browser dev tools are critical in identifying improper security boundaries.

Lessons Learned

  • Implement role-based access control (RBAC) enforced server-side.

​

  • Avoid exposing sensitive resource IDs directly in URLs. Use UUIDs or access tokens instead.

​

  • Implement centralized access control logic to avoid inconsistent enforcement.

​

  • Follow OWASP guidelines on Access Control Design and use tools like ZAP or Burp Pro for testing (OWASP, 2021).

Recommendations and Remediation

This lab reinforced the importance of rigorous access control implementation in web applications. By simulating attacks such as IDOR and privilege escalation, I gained firsthand insight into how attackers abuse weak access enforcement. Understanding and mitigating these vulnerabilities is crucial for building secure applications and defending against unauthorized access.

Conclusion

bottom of page