=

Broken Access Control

What is broken access control ?

Broken Access Control refers to thoes vulnerabilities that allow users to perform actions or access information they are not authorized to. This can lead to unauthorized information disclosure, modification, or destruction, and unintended tasks.

    Some types of broken access control :

  1. Violation of the Principle of Least Privilege
  2. Bypassing Access Control Checks
  3. Insecure Direct Object References
  4. Missing Access Controls on APIs
  5. Elevation of Privilege
  6. Metadata Manipulation
  7. CORS Misconfiguration
  8. Force Browsing

    Some possible broken access control attacks :

  1. Bypassing Authentication by Manipulating URL or HTTP Parameters
  2. Inadequate Session Management
  3. Forced Browsing to Access Restricted Resources
  4. Lack of Access Control Checks on APIs