Broken Access Control in Security Testing: Scenarios and Prevention Quiz

Explore key attack scenarios and prevention strategies related to broken access control from the OWASP Top 10. This quiz challenges your understanding of common vulnerabilities, real-world examples, and secure practices vital for effective security testing in modern applications.

1. Horizontal Access Control Failure

   In a social media platform, if a regular user manually changes a profile URL from /profile/1002 to /profile/1003 and gains access to another user's profile without permission, which type of broken access control is being exploited?

   1. Horizontal privilege escalation
   2. Vertical privilege escalation
   3. Session fixation
   4. Cross-site scripting

   Explanation: Horizontal privilege escalation occurs when a user is able to access resources of peers at the same privilege level, as in this scenario. Vertical privilege escalation, on the other hand, is when a user gains increased privileges beyond their assigned level. Session fixation is related to session management issues, not access rights. Cross-site scripting involves injecting malicious scripts, not unauthorized access.

2. Prevention Control Measures

   Which measure most effectively prevents broken access control vulnerabilities by ensuring users cannot access data or functions for which they lack authorization?

   1. Enforcing server-side authorization checks
   2. Validating email formats on the client side
   3. Hashing all sensitive user data
   4. Disabling browser autocomplete

   Explanation: Server-side authorization checks ensure that every request is properly validated against the user’s permissions, making them effective against access control issues. Client-side validation like email format checks do not enforce access controls and can be bypassed. Hashing data protects confidentiality, not access rights. Disabling browser autocomplete is unrelated to access control mechanisms.

3. Real-World Attack Pathways

   An attacker discovers that by sending specially crafted API requests, they can access administrative endpoints not shown in the user interface. Which vulnerability does this scenario best illustrate?

   1. Insecure direct object reference (IDOR)
   2. Security misconfiguration
   3. SQL injection
   4. Open redirect

   Explanation: IDOR occurs when access to resources is based on user-supplied input without proper authorization checks, enabling attackers to access unauthorized endpoints. While security misconfiguration can create risks, it is not specific to direct object references. SQL injection involves sending malicious database queries, not accessing endpoints. Open redirects allow URL redirection to untrusted locations but do not involve unauthorized API access.

4. Access Control Policy Best Practices

   What is the most effective way to design access control policies to minimize the risk of broken access control in web applications?

   1. Apply the principle of least privilege
   2. Allow all users temporary admin access
   3. Rely only on front-end checks
   4. Permit anonymous access for convenience

   Explanation: Applying the principle of least privilege means users get the minimum permissions needed to perform their tasks, greatly reducing the attack surface. Allowing temporary admin access elevates risk and violates sound policy. Relying on front-end checks alone is insecure because they can be bypassed. Permitting anonymous access increases exposure to unauthorized access.

5. Detection of Broken Access Control

   During a penetration test, which method is most effective for identifying broken access control vulnerabilities?

   1. Manually manipulating parameters and testing unauthorized actions
   2. Running only automated code linters
   3. Measuring page load speed
   4. Observing visual changes in the user interface

   Explanation: Actively manipulating parameters allows testers to discover if unauthorized access is possible, which is critical for finding broken access control flaws. Code linters generally detect code style or syntax errors, not authorization issues. Page load speed measurements are unrelated to security. Interface changes may not provide evidence of access control problems unless thoroughly tested.