🔓 Broken Access Control Attack Flow
OWASP #1 - Unauthorized Access to Resources
flowchart TD
A[👤 Attacker - Regular User] -->|1. Enumerate resources| B[🔍 Discovery Phase]
B -->|2. Find unprotected endpoint| C[🌐 Web Application]
C -->|3. Modify request parameters| D[📝 Direct Object Reference]
D -->|4. Access unauthorized resource| E[(💾 Database/Files)]
E -->|5. Return sensitive data| C
C -->|6. Data disclosed| A
F[🎯 Attack Vector:
URL Manipulation] -.->|user_id=123 to user_id=456| D
G[🎯 Attack Vector:
Path Traversal] -.->|/admin/dashboard| C
H[🎯 Attack Vector:
Forced Browsing] -.->|Hidden endpoints| B
style A fill:#ff6b6b,stroke:#f59e0b,stroke-width:2px,color:#fff
style B fill:#ffd43b,stroke:#f59e0b,stroke-width:2px,color:#000
style C fill:#74c0fc,stroke:#f59e0b,stroke-width:2px,color:#000
style D fill:#ff6b6b,stroke:#f59e0b,stroke-width:2px,color:#fff
style E fill:#a855f7,stroke:#f59e0b,stroke-width:2px,color:#fff
style F fill:#ff6b6b,stroke:#f59e0b,stroke-width:2px,color:#fff
style G fill:#ff6b6b,stroke:#f59e0b,stroke-width:2px,color:#fff
style H fill:#ff6b6b,stroke:#f59e0b,stroke-width:2px,color:#fff
I[🔒 Defense:
Authorization Checks] -.->|Verify permissions| C
J[🛡️ Defense:
Indirect References] -.->|Use tokens/UUIDs| D
K[⚙️ Defense:
Access Control Lists] -.->|Enforce policies| E
style I fill:#f59e0b,stroke:#00cc33,stroke-width:2px,color:#000
style J fill:#f59e0b,stroke:#00cc33,stroke-width:2px,color:#000
style K fill:#f59e0b,stroke:#00cc33,stroke-width:2px,color:#000
📋 Attack Flow Breakdown
1
Discovery & Enumeration: Attacker maps application structure and identifies potential access control weaknesses.
GET /api/users/123/profile
2
Parameter Tampering: Modify user IDs, role parameters, or URL paths to access unauthorized resources.
GET /api/users/456/profile (Another user's data)
3
Forced Browsing: Access administrative or hidden pages by guessing URLs.
GET /admin/dashboard | GET /api/internal/users
4
Privilege Escalation: Elevate privileges by manipulating role parameters.
POST /api/user/update {role: "admin"}
5
Data Exfiltration: Access sensitive data belonging to other users or administrators.
🛡️ Defense Mechanisms
✅ Implement Proper Authorization:
Check user permissions on every resource access, not just authentication.
if (!user.canAccess(resource)) return 403;
✅ Use Indirect Object References:
Never expose internal IDs. Use UUIDs or session-based mappings.
/api/profile/my-profile instead of /api/users/123
✅ Deny by Default:
All resources should be protected by default. Explicitly grant access.
Whitelist approach > Blacklist approach
✅ Log Access Control Failures:
Monitor and alert on repeated access control violations.
log.warn("Unauthorized access attempt to resource X by user Y")
✅ Disable Directory Listing:
Prevent attackers from enumerating files and directories.