Difference between revisions of "Testing for Bypassing Authorization Schema (OWASP-AZ-002)"

From OWASP
Jump to: navigation, search
m (Black Box testing and example)
(6 intermediate revisions by 3 users not shown)
Line 1: Line 1:
{{Template:OWASP Testing Guide v3}}
+
{{Template:OWASP Testing Guide v4}}
  
 
== Brief Summary ==
 
== Brief Summary ==
<br>
 
 
This kind of test focuses on verifying how the authorization schema has been implemented for each role/privilege to get access to reserved functions/resources.
 
This kind of test focuses on verifying how the authorization schema has been implemented for each role/privilege to get access to reserved functions/resources.
<br>
 
  
 
== Description of the Issue ==  
 
== Description of the Issue ==  
<br>
 
 
For every specific role the tester holds during the assessment, for every function and request that the application executes during the post-authentication phase, it is necessary to verify:
 
For every specific role the tester holds during the assessment, for every function and request that the application executes during the post-authentication phase, it is necessary to verify:
 
* Is it possible to access that resource even if the user is not authenticated?
 
* Is it possible to access that resource even if the user is not authenticated?
Line 14: Line 11:
 
* Try to access the application as an administrative user and track all the administrative functions. Is it possible to access administrative functions also if the tester is logged as a user with standard privileges?
 
* Try to access the application as an administrative user and track all the administrative functions. Is it possible to access administrative functions also if the tester is logged as a user with standard privileges?
 
* Is it possible to use these functionalities for a user with a different role and for whom that action should be denied?
 
* Is it possible to use these functionalities for a user with a different role and for whom that action should be denied?
<br>
 
  
 
== Black Box testing and example ==
 
== Black Box testing and example ==
'''Testing for Admind functionalities''' <br>
+
'''Testing for Admin functionalities''' <br>
 
For example, suppose that the 'AddUser.jsp' function is part of the administrative menu of the application, and it is possible to access it by requesting the following URL:
 
For example, suppose that the 'AddUser.jsp' function is part of the administrative menu of the application, and it is possible to access it by requesting the following URL:
 
* https://www.example.com/admin/addUser.jsp  
 
* https://www.example.com/admin/addUser.jsp  
Line 29: Line 25:
 
  userID=fakeuser&role=3&group=grp001
 
  userID=fakeuser&role=3&group=grp001
  
What happens if a not administrative user tries to execute that request? Will the user be created? If so, can the new user use her privileges?
+
What happens if a non-administrative user tries to execute that request? Will the user be created? If so, can the new user use her privileges?
  
 
'''Testing for access to resources assigned to a different role''' <br>
 
'''Testing for access to resources assigned to a different role''' <br>
Line 35: Line 31:
  
 
'''Result Expected:'''<br>
 
'''Result Expected:'''<br>
Execute administrative functions or access administrative resources as a standard user.
+
Try to execute administrative functions or access administrative resources as a standard user.
 
<br><br>
 
<br><br>
  
== Gray Box testing and example ==
 
'''Testing for Topic X vulnerabilities:'''<br>
 
...<br>
 
'''Result Expected:'''<br>
 
...<br><br>
 
 
== References ==
 
== References ==
'''Whitepapers'''<br>
 
...<br>
 
 
'''Tools'''<br>
 
'''Tools'''<br>
...<br>
+
* OWASP WebScarab: [[OWASP_WebScarab_Project]]<br>

Revision as of 09:47, 16 October 2012

This article is part of the new OWASP Testing Guide v4. 
At the moment the project is in the REVIEW phase.

Back to the OWASP Testing Guide v4 ToC: https://www.owasp.org/index.php/OWASP_Testing_Guide_v4_Table_of_Contents Back to the OWASP Testing Guide Project: http://www.owasp.org/index.php/OWASP_Testing_Project

Contents


Brief Summary

This kind of test focuses on verifying how the authorization schema has been implemented for each role/privilege to get access to reserved functions/resources.

Description of the Issue

For every specific role the tester holds during the assessment, for every function and request that the application executes during the post-authentication phase, it is necessary to verify:

  • Is it possible to access that resource even if the user is not authenticated?
  • Is it possible to access that resource after the log-out?
  • Is it possible to access functions and resources that should be accessible to a user that holds a different role/privilege?
  • Try to access the application as an administrative user and track all the administrative functions. Is it possible to access administrative functions also if the tester is logged as a user with standard privileges?
  • Is it possible to use these functionalities for a user with a different role and for whom that action should be denied?

Black Box testing and example

Testing for Admin functionalities
For example, suppose that the 'AddUser.jsp' function is part of the administrative menu of the application, and it is possible to access it by requesting the following URL:

Then, the following HTTP request is generated when calling the AddUser function:

POST /admin/addUser.jsp HTTP/1.1
Host: www.example.com
[other HTTP headers]
userID=fakeuser&role=3&group=grp001

What happens if a non-administrative user tries to execute that request? Will the user be created? If so, can the new user use her privileges?

Testing for access to resources assigned to a different role
Analyze, for example, an application that uses a shared directory to store temporary PDF files for different users. Suppose that documentABC.pdf should be accessible only by the user test1 with roleA. Verify if user test2 with roleB can access that resource.

Result Expected:
Try to execute administrative functions or access administrative resources as a standard user.

References

Tools