Access control: IDOR and privilege checks
You learn where authorisation checks get forgotten in code, how to recognise IDOR and privilege escalation with two accounts, and how to close them for good with a central policy layer.
Level 201 · 16 lessons · 14 practice labs
Lessons
Concepts
- Access models: RBAC, ABAC and ownership checks
- Horizontal and vertical privilege escalation
- Where the check belongs: middleware, controller or data layer
- Deny by default: the forgotten endpoints
- Short task: draw the role and endpoint access matrix for the lab app
Recognising the flaws
- How IDOR is born in code: taking the ID from the request and querying it
- Recognising IDOR with two accounts in Burp
- Function-level access: hidden admin endpoints
- Mass assignment: the "role" field slipped into a request
- Tenant isolation in multi-tenant apps
- Short task: evidence three different access-control flaws
Fixing and monitoring
- Central authorisation: a single policy layer
- Indirect references and unguessable IDs: why they are not enough alone
- Automated tests for access control
- Logging denied access and raising alerts
- Capstone: close the access flaws in a multi-role app and retest against the matrix
Practice labs
- Change the order number: someone else's order: Compare order detail access with two accounts, prove another user's order opens and add an ownership check.
- IDOR in a file download: Reach another customer's document by changing the ID in the download link and bind the download to the owner.
- IDOR in an update request: Prove that changing the record ID in an address update changes someone else's address and add an ownership condition to the query.
- Unguessable IDs are not enough: On an endpoint with UUIDs but no ownership check, find another user's ID in responses, reach their record and make the real fix.
- Tenant isolation: another company's invoices: Reach another company's data by changing the tenant ID in the multi-tenant app and move the tenant filter into the data layer.
- An admin endpoint with a customer session: Find an admin endpoint callable with a customer session and close it with a default-deny rule.
- A role field added to the profile update: Prove a role field added to the profile update request is accepted and bind updatable fields to an allow list.
- A staff function hidden only in the UI: Call the refund approval function, hidden in the UI but unprotected on the server, with a customer account and add the role check.
- Price and approval fields through mass assignment: Show price and approval fields can be set from outside in the order creation request, separate fields with a DTO and verify with tests.
- A forgotten old endpoint: /v1/users: Find the user list endpoint protected in the new version but open in the old one and connect it to the shared authorisation layer.
- Map the role and endpoint matrix: Put the lab app's roles and endpoints in a table and mark the rows where expected and actual access differ.
- Move scattered checks into one policy: Move role checks scattered across controllers into a central authorisation layer and test that no endpoint is left out.
- An automated access control test: Write a test that tries the expected result for every role and endpoint pair and show it catches a deliberate mistake.
- Spotting an IDOR scan from refused access: Log refused access, set an alert that catches a user trying sequential IDs and test it with replayed traffic.
About this course
You learn where authorisation checks get forgotten in code, how to recognise IDOR and privilege escalation with two accounts, and how to close them for good with a central policy layer.
What you will learn
- Concepts
- Recognising the flaws
- Fixing and monitoring
Prerequisites
Finishing the level 101 courses of the same path, or knowing those topics, is enough.
Lab environment
Lessons run on your own Kali Linux desktop in the browser, with the tools ready in their windowed interfaces. Nothing to install; a computer screen is recommended.
Frequently asked questions
- Is this course right for my level?
- The course is at level 201; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.