Assessing Authorization Checks

This chapter covers the basics of authorization, including an explanation of how an application uses roles to determine user functions. Web penetration testing involves key assessments to determine how well the application validates functions assigned to a given role or individual user, and we will learn how to use Burp Suite to perform these tests.

In this chapter, we will cover the following recipes:

• Testing for directory traversal
• Testing for Local File Inclusion (LFI)
• Testing for Remote File Inclusion (RFI)
• Testing for privilege escalation
• Testing for Insecure Direct Object Reference (IDOR)

Technical requirements

To complete the recipes in this chapter, you will need the following:

• OWASP Broken Web Applications (BWA) VM: the OWASP Mutillidae application
• Burp Suite Proxy Community or Professional (https://portswigger.net/burp/)
• The use of a PortSwigger account to access Web Security Academy (https://portswigger.net/web-security/all-labs)
• A Firefox browser configured to allow Burp Suite to proxy traffic (https://www.mozilla.org/en-US/firefox/new/)
• The wfuzz wordlist repository from GitHub (https://github.com/xmendez/wfuzz)

Testing for directory traversal

Directory traversal attacks are attempts to discover or force-browse unauthorized web pages usually designed for administrators of the application. If an application does not configure the web document root properly and does not include proper authorization checks on the server side for each page accessed, a directory traversal vulnerability may exist. This type of weakness allows an attack to perform system command injection exploitation or arbitrary code execution.

Getting ready

Using OWASP Mutillidae II as our target application, let’s determine whether it contains any directory traversal vulnerabilities.

Ensure that Burp Suite and the OWASP BWA VM are running, that Burp Suite is configured in the Firefox browser (or use the Burp Suite browser), and that you are viewing the OWASP BWA applications.

How to do it...

1. From the OWASP BWA landing page, click the link to the OWASP Mutillidae II application.
2. Open the login screen...

Testing for LFI

Web servers control access to privileged files and resources using configuration settings. Privileged files include files that should only be accessible to system administrators – for example, the /etc/passwd file on Unix-like platforms or the boot.ini file on Windows systems.

An LFI attack is an attempt to access privileged files using directory traversal attacks. LFI attacks include different styles, including dot-dot-slash attacks (../), directory brute-forcing, directory climbing, or backtracking.

Getting ready

Using OWASP Mutillidae II as our target application, let’s determine whether it contains any LFI vulnerabilities.

Ensure Burp Suite and OWASP BWA VM are running and that Burp Suite is configured in the Firefox browser used to view the OWASP BWA applications.

How to do it...

1. From the OWASP BWA Landing page, click the link to the OWASP Mutillidae II application.
2. Open the login screen of OWASP Mutillidae II in the Firefox...

Testing for RFI

RFI is an attack that attempts to access external URLs and remotely located files. This kind of attack is possible due to parameter manipulation, a lack of server-side checks, and a lack of whitelisting for outbound traffic at the firewall level. These oversights may lead to data exfiltration of user information to external servers controlled by an attacker.

Getting ready

Using OWASP Mutillidae II as our target application, let’s determine whether it contains any RFI vulnerabilities.

Ensure Burp Suite and OWASP BWA VM are running and that Burp Suite is configured in the Firefox browser used to view the OWASP BWA applications.

How to do it...

1. From the OWASP BWA landing page, click the link to the OWASP Mutillidae II application.
2. Open the login screen of OWASP Mutillidae II in the Firefox browser. From the top menu, click Login.
3. Find the request you just performed within the Proxy | HTTP history table. Look for the call to the login...

Testing for privilege escalation

Developer code in an application must include authorization checks on assigned roles to ensure an authorized user is not able to elevate their role to a higher privilege. As an attacker, frequent targets for accessing elevated functionality include parameter tampering, forced browsing, and authentication bypass. These types of privilege escalation attacks may potentially occur by modifying the value of an assigned role or parameter value and replacing that value with another. If the attack is successful, the bad actor gains unauthorized access to resources or functionality normally restricted to administrators or more powerful accounts.

Getting ready

Let’s use the Privilege escalation via server-side prototype pollution PortSwigger lab, which is located in the Prototype pollution section of All labs, as our target application. We will attempt to find a weakness in the Node.js inheritance hierarchy to elevate our privileges within the appli...

Testing for IDOR

Allowing unauthorized direct access to files or resources on a system based on user-supplied input is known as IDOR. This vulnerability allows us to bypass authorization checks placed on such files or resources. IDOR is a result of unchecked user-supplied input to retrieve an object without performing authorization checks in the application code.

Getting ready

Let’s use the Insecure direct object references PortSwigger lab, which is located in the Access control section of All labs, as our target application. We will attempt to find a direct object reference used as a value to a parameter, manipulate it, and access information that should normally not be seen.

Log in to your PortSwigger account and navigate to the following URL: https://portswigger.net/web-security/access-control/lab-insecure-direct-object-references. Ensure Burp Suite is running and sending traffic through either Firefox or the Burp Suite browser.

How to do it...

1. From the...