Exploring broken access control attacks

Broken access controls permit both authenticated and unauthenticated users to perform actions on a web application or systems that are not permitted. Implementing access controls on a system and even web applications helps administrators restrict access to sensitive and confidential directories and data from unauthorized users.

However, while many organizations will implement a pre-built web application framework on their web server, many pre-built and ready-to-use web application frameworks contain default security configurations, and if implemented without using best practices, threat actors can simply gain unauthorized access by exploiting the broken access control mechanisms.

In this section, you will gain hands-on experience in discovering and exploiting the security vulnerabilities of broken access control on a vulnerable web application such as OWASP Juice Shop.

To get started with this exercise, please follow these instructions...