WEB-ACCESS-01 - Broken Access Control

Session Overview

Learning Objectives

• Understand access control mechanisms and their importance
• Identify common access control vulnerabilities
• Practice exploiting broken access control using OS³ Studio
• Learn secure access control implementation patterns
• Explore career opportunities in access control security

What is Access Control?

Access Control determines who can access what resources and under what conditions.

Core Principles:

• Authentication: "Who are you?" - Verifying identity
• Authorization: "What can you do?" - Determining permissions
• Accountability: "What did you do?" - Tracking actions

Types of Access Control

1. Discretionary Access Control (DAC)

• Resource owners control access
• Common in file systems
• Flexible but can be insecure

2. Mandatory Access Control (MAC)

• System-enforced policies
• Used in military/government
• Highly secure but inflexible

3. Role-Based Access Control (RBAC)

• Access based on user roles
• Most common in web applications
• Balances security and usability

Common Access Control Vulnerabilities

GET /admin/users → Should require admin role

GET /users/123/profile → User 456 accessing User 123's data

Missing Function Level Access Control

GET /api/documents/456 → No check if user owns document 456

Common Scenarios:

• Direct database queries without authorization
• File system access without permission checks
• API endpoints without role verification
• Administrative functions accessible to regular users

OS³ Studio Lab Environment

Common Attack Vectors

1. URL Manipulation

• Changing user IDs in URLs
• Accessing admin panels directly
• Bypassing authentication checks

2. Parameter Tampering

• Modifying form parameters
• Changing role values
• Manipulating session data

3. Directory Traversal

• Accessing restricted directories
• Bypassing path restrictions
• Reading sensitive files

Real-World Impact

Detection Methods

Manual Testing:

• Role-based testing with different user accounts
• URL manipulation and parameter tampering
• Session management analysis

Automated Testing:

• Burp Suite Professional
• OWASP ZAP
• Custom scripts for authorization testing

Prevention Strategies

1. Implement Proper Authorization

• Check permissions on every request
• Use role-based access control (RBAC)
• Implement principle of least privilege

2. Secure Session Management

• Use secure session tokens
• Implement proper session timeout
• Validate session state on every request

3. Regular Security Testing

• Conduct regular penetration tests
• Implement automated security scanning
• Review access control policies regularly

Industry Standards and Frameworks

Security Frameworks:

• NIST Cybersecurity Framework
• ISO 27001
• OWASP ASVS (Application Security Verification Standard)

Compliance Requirements:

• GDPR: Data protection and access control
• PCI DSS: Payment card industry standards
• HIPAA: Healthcare data protection

Career Paths in Access Control

Tools and Technologies

Identity and Access Management (IAM):

• Auth0: Identity-as-a-Service platform
• Okta: Enterprise identity management
• Microsoft Azure AD: Cloud identity services
• Keycloak: Open-source identity management

Testing Tools:

• Burp Suite: Web application security testing
• OWASP ZAP: Free security testing tool
• Postman: API testing and development

Security Best Practices

Development Phase:

• Implement security by design
• Use secure coding practices
• Conduct regular code reviews
• Test authorization thoroughly

Deployment Phase:

• Use secure configuration
• Implement monitoring and logging
• Regular security updates
• Incident response planning

Common Mistakes to Avoid

Red Flags:

• Authorization checks only in JavaScript
• Admin functions accessible via direct URLs
• No session timeout implementation
• Predictable session tokens

Legal and Ethical Considerations

Ethical Guidelines:

• Always get proper authorization
• Follow responsible disclosure
• Respect privacy and data protection
• Report vulnerabilities responsibly

Secure Implementation Patterns

1. Server-Side Authorization

<!-- Always check permissions on the server -->
if (user.hasRole('admin') && user.canAccess(resource)) {
  return resource;
} else {
  throw new UnauthorizedException();
}

2. Role-Based Access Control

• Define clear roles and permissions
• Implement role hierarchy
• Use principle of least privilege

Secure Session Management

Best Practices:

• Secure Session Tokens: Use cryptographically secure random tokens
• Session Timeout: Implement automatic logout
• Session Validation: Check session state on every request
• Secure Storage: Store sessions securely on server

<!-- Secure session implementation -->
const session = {
  id: crypto.randomBytes(32).toString('hex'),
  userId: user.id,
  role: user.role,
  expiresAt: Date.now() + SESSION_TIMEOUT,
  lastActivity: Date.now()
};

Input Validation and Sanitization

Critical Security Measures:

• Validate all inputs: Check data types, ranges, and formats
• Sanitize user data: Remove or escape dangerous characters
• Use parameterized queries: Prevent SQL injection
• Implement CSRF protection: Prevent cross-site request forgery

<!-- Input validation example -->
function validateUserId(userId) {
  if (!userId || !Number.isInteger(userId) || userId <= 0) {
    throw new ValidationError('Invalid user ID');
  }
  return userId;
}

Monitoring and Logging

Security Monitoring:

• Access Logs: Track all access attempts
• Failed Authentication: Monitor login failures
• Privilege Escalation: Alert on suspicious activity
• Anomaly Detection: Identify unusual patterns

<!-- Security logging example -->
logger.warn('Unauthorized access attempt', {
  userId: user.id,
  resource: requestedResource,
  ip: request.ip,
  userAgent: request.headers['user-agent'],
  timestamp: new Date()
});

Testing Secure Implementation

Security Testing Checklist:

• ✓ Test all user roles and permissions
• ✓ Verify session timeout works correctly
• ✓ Test input validation with malicious data
• ✓ Check error handling doesn't leak information
• ✓ Verify logging captures security events

Industry Tools and Resources

Professional Tools:

• Burp Suite Professional: Advanced web security testing
• OWASP ZAP: Free, open-source security scanner
• Nessus: Vulnerability assessment tool
• Metasploit: Penetration testing framework

Career Development in Access Control

Certifications to Consider:

• CEH (Certified Ethical Hacker): Ethical hacking certification
• CISSP (Certified Information Systems Security Professional): Advanced security certification
• CISM (Certified Information Security Manager): Security management
• CompTIA Security+: Entry-level security certification

Summary and Key Takeaways

What We've Learned:

• Access control is fundamental to application security
• Broken access control is the #1 OWASP vulnerability
• Proper implementation requires server-side validation
• Security testing should be continuous and systematic
• Strong career opportunities exist in access control security