testing-for-broken-access-control skill by mukul975

Testing for Broken Access Control

When to Use

During authorized penetration tests as the primary assessment for OWASP A01:2021 - Broken Access Control
When evaluating role-based access control (RBAC) implementations across all application endpoints
For testing multi-tenant applications where users in one organization should not access another's data
When assessing API endpoints for missing or inconsistent authorization checks
During security audits where privilege escalation and unauthorized access are primary concerns

Prerequisites

Authorization: Written penetration testing agreement for the target
Burp Suite Professional: With Authorize extension for automated access control testing
Multiple test accounts: Accounts at each role level (admin, manager, user, guest)
Application role matrix: Documentation of what each role should and should not access
curl/httpie: For manual endpoint testing with different authentication contexts
ffuf: For discovering hidden endpoints that may lack access controls

Workflow

Step 1: Map All Endpoints and Create Access Control Matrix

Document every endpoint and the expected access level for each role.

# Extract all endpoints from Burp Site Map
# Target > Site Map > Right-click > Copy URLs in this host
 
# Build a matrix of endpoints vs roles:
# | Endpoint              | Admin | Manager | User | Guest |

Step 2: Configure Automated Access Control Testing

Set up Burp Authorize extension for parallel role-based testing.

Step 3: Test Vertical Privilege Escalation

Attempt to access higher-privilege functionality with lower-privilege accounts.

Step 4: Test Horizontal Privilege Escalation

Verify that users cannot access resources belonging to other users at the same privilege level.

Step 5: Test Function-Level Access Control

Verify that specific functions enforce authorization properly.

Step 6: Test Multi-Tenant Isolation

Verify that tenant boundaries are enforced in multi-tenant applications.

Key Concepts

Concept	Description
Vertical Privilege Escalation	Lower-privilege user accessing higher-privilege functionality (user -> admin)
Horizontal Privilege Escalation	User accessing another user's resources at the same privilege level
Function-Level Access Control	Authorization checks on specific features/functions regardless of URL
RBAC	Role-Based Access Control - permissions assigned to roles, roles assigned to users
ABAC	Attribute-Based Access Control - permissions based on user/resource/environment attributes
Multi-Tenant Isolation	Ensuring data and functionality separation between different organizations/tenants
Insecure Direct Object Reference	Accessing objects by manipulating identifiers without authorization checks
Missing Function-Level Check	Endpoint exists but does not verify the caller has permission to invoke it

Tools & Systems

Tool	Purpose
Burp Suite Professional	Request interception and role-based testing
Authorize (Burp Extension)	Automated access control testing across sessions
AutoRepeater (Burp Extension)	Automatically replays requests with different auth contexts
Postman	API testing with environment switching between roles
ffuf	Discovering hidden endpoints that may lack access controls
OWASP ZAP	Access control testing with context-aware scanning

Common Scenarios

Scenario 1: Admin Panel Without Auth Check

The /admin/dashboard endpoint returns the admin panel when accessed with a regular user's session token. The front-end hides the admin menu, but the back-end does not enforce role checks.

Scenario 2: API Endpoint Missing Authorization

The DELETE /api/users/{id} endpoint checks for authentication (valid token) but not authorization (admin role). Any authenticated user can delete any other user's account.

Scenario 3: Tenant Data Leakage

A SaaS application uses tenant_id in API request headers. Changing the X-Tenant-ID header to another tenant's ID returns their data, bypassing tenant isolation.

Scenario 4: Mass Assignment Role Escalation

The user profile update endpoint at PUT /api/users/{id} accepts a role field in the JSON body. Submitting "role":"admin" alongside a profile update elevates the user to administrator.

Output Format