Testing for Bypassing Authorization Schema (OTG-AUTHZ-002) - Revision history

Andrew Muller: Andrew Muller moved page Testing for Bypassing Authorization Schema (OTG-AUTHZ-003) to Testing for Bypassing Authorization Schema (OTG-AUTHZ-002)

2014-08-08T11:57:03Z

Andrew Muller moved page Testing for Bypassing Authorization Schema (OTG-AUTHZ-003) to Testing for Bypassing Authorization Schema (OTG-AUTHZ-002)

Andrew Muller: Andrew Muller moved page Testing for Bypassing Authorization Schema (OWASP-AZ-002) to Testing for Bypassing Authorization Schema (OTG-AUTHZ-003): Align with Common Numbering

2014-08-05T13:16:27Z

Andrew Muller moved page Testing for Bypassing Authorization Schema (OWASP-AZ-002) to Testing for Bypassing Authorization Schema (OTG-AUTHZ-003): Align with Common Numbering

Jane O'Connor: Added Andrew's changes.

2014-08-01T20:08:28Z

Added Andrew's changes.

Jane O'Connor: Final edit

2014-05-14T18:53:49Z

Final edit

Lvsteche: Minor corrections.

2014-03-25T11:30:24Z

Minor corrections.

Mmeucci at 14:47, 16 October 2012

2012-10-16T14:47:36Z

KirstenS: /* Description of the Issue */

2009-02-06T15:24:19Z

‎Description of the Issue

KirstenS: /* Brief Summary */

2009-02-06T15:23:53Z

‎Brief Summary

KirstenS: Testing for Bypassing Authorization Schema moved to Testing for Bypassing Authorization Schema (OWASP-AZ-002)

2008-12-07T17:40:48Z

Testing for Bypassing Authorization Schema moved to Testing for Bypassing Authorization Schema (OWASP-AZ-002)

Namn: /* Black Box testing and example */

2008-09-07T10:24:02Z

‎Black Box testing and example

@@ Line 1: / Line 1: @@
 {{Template:OWASP Testing Guide v4}}
-== Brief Summary ==
+== Summary ==
 This kind of test focuses on verifying how the authorization schema has been implemented for each role or privilege to get access to reserved functions and resources.
-−
 For every specific role the tester holds during the assessment, for every function and request that the application executes during the post-authentication phase, it is necessary to verify:
 * Is it possible to access that resource even if the user is not authenticated?
@@ Line 17: / Line 16: @@
-== Black Box testing and example ==
+== How to test ==
 '''Testing for access to administrative functions''' <br>
 For example, suppose that the 'AddUser.jsp' function is part of the administrative menu of the application, and it is possible to access it by requesting the following URL:
@@ Line 40: / Line 39: @@
 <br><br>
-== References ==
+== Tools==
 * OWASP WebScarab: [[OWASP WebScarab Project]]<br>

@@ Line 2: / Line 2: @@
 == Brief Summary ==
-This kind of test focuses on verifying how the authorization schema has been implemented for each role/privilege to get access to reserved functions/resources.
+This kind of test focuses on verifying how the authorization schema has been implemented for each role or privilege to get access to reserved functions and resources.
 == Description of the Issue ==
@@ Line 8: / Line 9: @@
 * Is it possible to access that resource even if the user is not authenticated?
 * Is it possible to access that resource after the log-out?
-* Is it possible to access functions and resources that should be accessible to a user that holds a different role/privilege?
+* Is it possible to access functions and resources that should be accessible to a user that holds a different role or privilege?
 Try to access the application as an administrative user and track all the administrative functions.
 * Is it possible to access administrative functions also if the tester is logged as a user with standard privileges?
 * Is it possible to use these administrative functions as a user with a different role and for whom that action should be denied?
 == Black Box testing and example ==
@@ Line 17: / Line 21: @@
 For example, suppose that the 'AddUser.jsp' function is part of the administrative menu of the application, and it is possible to access it by requesting the following URL:
    https://www.example.com/admin/addUser.jsp
 Then, the following HTTP request is generated when calling the AddUser function:
@@ Line 27: / Line 32: @@
 </pre>
-What happens if a non-administrative user tries to execute that request? Will the user be created? If so, can the new user use her privileges?
 '''Testing for access to resources assigned to a different role''' <br>
-Analyze, for example, an application that uses a shared directory to store temporary PDF files for different users. Suppose that documentABC.pdf should be accessible only by the user test1 with roleA. Verify if user test2 with roleB can access that resource.
+For example analyze an application that uses a shared directory to store temporary PDF files for different users. Suppose that documentABC.pdf should be accessible only by the user test1 with roleA. Verify if user test2 with roleB can access that resource.
 <br><br>

@@ Line 9: / Line 9: @@
 * Is it possible to access that resource after the log-out?
 * Is it possible to access functions and resources that should be accessible to a user that holds a different role/privilege?
-* Try to access the application as an administrative user and track all the administrative functions. Is it possible to access administrative functions also if the tester is logged as a user with standard privileges?
+Try to access the application as an administrative user and track all the administrative functions.
-* Is it possible to use these functionalities for a user with a different role and for whom that action should be denied?
+* Is it possible to access administrative functions also if the tester is logged as a user with standard privileges?
 == Black Box testing and example ==
-'''Testing for Admin functionalities''' <br>
+'''Testing for access to administrative functions''' <br>
 For example, suppose that the 'AddUser.jsp' function is part of the administrative menu of the application, and it is possible to access it by requesting the following URL:
-* https://www.example.com/admin/addUser.jsp
+  https://www.example.com/admin/addUser.jsp
 Then, the following HTTP request is generated when calling the AddUser function:
- POST /admin/addUser.jsp HTTP/1.1
+userID=fakeuser&role=3&group=grp001
- Host: www.example.com
+</pre>
 What happens if a non-administrative user tries to execute that request? Will the user be created? If so, can the new user use her privileges?
@@ Line 29: / Line 31: @@
 '''Testing for access to resources assigned to a different role''' <br>
 Analyze, for example, an application that uses a shared directory to store temporary PDF files for different users. Suppose that documentABC.pdf should be accessible only by the user test1 with roleA. Verify if user test2 with roleB can access that resource.
 <br><br>
 == References ==
 '''Tools'''<br>
-* OWASP WebScarab: [[OWASP_WebScarab_Project]]<br>
+* OWASP WebScarab: [[OWASP WebScarab Project]]<br>

← Older revision		Revision as of 14:47, 16 October 2012
Line 1:		Line 1:
−	{{Template:OWASP Testing Guide v3}}	+	{{Template:OWASP Testing Guide v4}}

	== Brief Summary ==		== Brief Summary ==

@@ Line 5: / Line 5: @@
 == Description of the Issue ==
 For every specific role the tester holds during the assessment, for every function and request that the application executes during the post-authentication phase, it is necessary to verify:
 * Is it possible to access that resource even if the user is not authenticated?
@@ Line 12: / Line 11: @@
 * Try to access the application as an administrative user and track all the administrative functions. Is it possible to access administrative functions also if the tester is logged as a user with standard privileges?
 * Is it possible to use these functionalities for a user with a different role and for whom that action should be denied?
 == Black Box testing and example ==

← Older revision	Revision as of 11:57, 8 August 2014
(No difference)

← Older revision	Revision as of 13:16, 5 August 2014
(No difference)

← Older revision	Revision as of 17:40, 7 December 2008
(No difference)