Skip to content

04-authorisation.md

Latest commit

 

History

History
73 lines (52 loc) · 2.53 KB

04-authorisation.md

File metadata and controls

73 lines (52 loc) · 2.53 KB
Raw

04 — Authorisation

Auth is "who are you?" Authorisation is "what are you allowed to do?" The second is where most bug bounty payouts live.

IDOR (Insecure Direct Object Reference)

The simplest and most-overlooked finding.

# user A's request
GET /api/orders/12345    Authorization: Bearer A_TOKEN

# try with user B's token
GET /api/orders/12345    Authorization: Bearer B_TOKEN

If you get user A's order back as user B → IDOR.

Variants to try:

  • Numeric increments (/orders/12345 → /orders/12346).
  • UUIDs (often think they're safe — they're predictable when guessable from another endpoint).
  • POST/PUT bodies, not just URL params ({"order_id": 12345}).
  • Path traversal in identifiers (/users/me/../12345/orders).
  • Different verbs (POST might check, GET/DELETE might not).

RBAC bypass

Roles checked client-side only:

  • Hide buttons but server still allows the request.
  • role field in JWT — change locally, doesn't matter unless server validates.
  • Forced browsing — guess admin endpoints (/admin/users, /internal/).

Header-based privilege:

  • X-Original-URL, X-Rewrite-URL for ACL bypass.
  • X-Forwarded-For: 127.0.0.1 for IP-restricted admin pages.
  • Custom headers like X-User-Role: admin — almost never trusted, but check.

Mass assignment

# normal signup
POST /api/users
{"email": "x@y.com", "password": "..."}

# add fields
POST /api/users
{"email": "x@y.com", "password": "...", "role": "admin", "is_verified": true}

If the server blindly hydrates the model from JSON, you've escalated.

Vertical vs horizontal

  • Horizontal — same role, different user (most IDOR).
  • Vertical — lower role accessing higher-role resources (RBAC bypass).

Always test both with a 2-account setup (low-priv + admin).

Two-account method

  1. Login as low. Capture every authenticated request to a file (Burp logger).
  2. Login as admin. Browse the same flows. Capture.
  3. Replay each admin-captured request with low's token.
  4. Anything that succeeds = vertical authz bug.
  5. Replay each userA-captured request with userB's token.
  6. Anything that returns A's data = horizontal authz bug.

What gets missed

  • DELETE / PATCH endpoints — devs forget to lock these because the UI doesn't expose them to non-admins.
  • Bulk endpoints (/api/orders?ids=1,2,3,4) — auth check might apply per-request, not per-ID.
  • WebSocket messages — same auth rules, often only enforced on the upgrade handshake.
  • File downloads — /files/12345.pdf might bypass session checks.