Gain Privileges Using Broken Access Control
In this lab, you'll practice exploiting broken access controls. When you're finished, you'll have successfully navigated a rogue application, elevated privileges, and uncovered hidden data.
Terms and conditions apply.
Challenge
Getting Started in the Lab Environment
Here are the initial instructions and explanation of the lab environment. Read this while your environment is busy creating itself from nothing. Yes, this violates physics; we know. How fun!
Challenge
Analyze Authentication and Role-Based Access Controls
In this challenge, you will investigate how the application manages user authentication and roles. You will review the process, data being transferred, and look for weaknesses.
Challenge
Compare Sitemaps and Exploit Role-Based Access Control
Look at the site from the perspective of two different roles, to understand what can and cannot be accessed from each. Explore how the controls are implemented and then exploit a vulnerability.
Challenge
Escalate Privileges and Exploit Vulnerabilities
Your goal is to exploit the Access Control vulnerabilities that were discovered in the previous challenges. You will escalate privileges to access otherwise restricted resources.
Challenge
The Last Challenge
Welcome to the final challenge! This is your last chance to experiment in the environment. Clicking Finish Lab will end this little world that flittered into existence just for you.
Provided environment for hands-on practice
We will provide the credentials and environment necessary for you to practice right within your browser.
Guided walkthrough
Follow along with the author’s guided walkthrough and build something new in your provided environment!
Did you know?
On average, you retain 75% more of your learning if you get time for practice.
Recommended prerequisites
- Foundational security knowledge
- Basic networking and HTTP concepts
- Basic knowledge of Burp Suite Pro or another Intercepting Proxy