Difference between revisions of "Testing for Bypassing Authorization Schema (OWASP-AZ-002)"

From OWASP
Jump to: navigation, search
Line 18: Line 18:
  
 
== Black Box testing and example ==
 
== Black Box testing and example ==
'''Testing for Topic X vulnerabilities:''' <br>
+
'''Testing for Admind functionalities''' <br>
 
For example if the application 'AddUser.jsp' is a part of the administrative menu of the application, and it is possible to access request the following URL:
 
For example if the application 'AddUser.jsp' is a part of the administrative menu of the application, and it is possible to access request the following URL:
 
* https://www.example.com/admin/addUser.jsp  
 
* https://www.example.com/admin/addUser.jsp  
Line 33: Line 33:
 
What if a not adimistrative user try to execute that request?
 
What if a not adimistrative user try to execute that request?
 
The user will be created? He can use his privileges?
 
The user will be created? He can use his privileges?
 +
 +
'''Testing for access to resources assigned to a different role''' <br>
 +
Analyze for example an applicaton that uses a shared directory to store temporary pdf file to gives to the user.
 +
documentABC.pdf should be accessible only by the user test1 with roleA. Verify is user test2 wiht roleB can access to that resource.
  
  

Revision as of 12:48, 28 June 2008

OWASP Testing Guide v3 Table of Contents

This article is part of the OWASP Testing Guide v3. The entire OWASP Testing Guide v3 can be downloaded here.

OWASP at the moment is working at the OWASP Testing Guide v4: you can browse the Guide here

Contents


This is a draft of a section of the new Testing Guide v3

Brief Summary


This kind of test focuses on verify how the authorization schema has been impleemted for each role/privilege to access to reserved functions/resources.

Description of the Issue


For every specif roles the tester holds during the assessment, for every function and request that the application executes during the post-authentication phase, it is necessary to verify:

  • It's possible to access to that resource also if the user is not authenticated?
  • It is possible to access after the log-out?
  • It is possible to access to functions and resources that should be accessible to a user that holds a different role/privilege?
  • Try to access to the application as an administrative user and track all the adiministrative functions. It is possible to access to administrative functions also if the tester is logged as a user with standard privileges?
  • It is possible to use these functionalities for a user with different role and for whom that action should be denied?


Black Box testing and example

Testing for Admind functionalities
For example if the application 'AddUser.jsp' is a part of the administrative menu of the application, and it is possible to access request the following URL:


The following HTTP request is generated calling the AddUser function:

POST /admin/addUser.jsp HTTP/1.1
Host: www.example.com
[others HTTP headers]
userID=fakeuser&ruolo=3&gruppo=grp001

What if a not adimistrative user try to execute that request? The user will be created? He can use his privileges?

Testing for access to resources assigned to a different role
Analyze for example an applicaton that uses a shared directory to store temporary pdf file to gives to the user. documentABC.pdf should be accessible only by the user test1 with roleA. Verify is user test2 wiht roleB can access to that resource.


Result Expected:
Execute administrative functions or access to administrative resources as a standard user.

Gray Box testing and example

Testing for Topic X vulnerabilities:
...
Result Expected:
...

References

Whitepapers
...
Tools
...