This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org

Difference between revisions of "Testing for Bypassing Authorization Schema (OTG-AUTHZ-002)"

From OWASP
Jump to: navigation, search
 
(16 intermediate revisions by 7 users not shown)
Line 1: Line 1:
{{Template:OWASP Testing Guide v3}}
+
{{Template:OWASP Testing Guide v4}}
  
'''This is a draft of a section of the new Testing Guide v3'''
+
== Summary ==
 +
This kind of test focuses on verifying how the authorization schema has been implemented for each role or privilege to get access to reserved functions and resources.
  
== Brief Summary ==
+
<br>
+
For every specific role the tester holds during the assessment, for every function and request that the application executes during the post-authentication phase, it is necessary to verify:
This kind of test focuses on verify how the authorization schema has been impleemted for each role/privilege to access to reserved functions/resources.
+
* Is it possible to access that resource even if the user is not authenticated?
<br>
+
* Is it possible to access that resource after the log-out?
== Description of the Issue ==
+
* Is it possible to access functions and resources that should be accessible to a user that holds a different role or privilege?  
<br>
+
 
For every specif roles the tester holds during the assessment, for every function and request that the application executes during the post-authentication phase, it is necessary to verify:
+
 
* It's possible to access to that resource also if the user is not authenticated?
+
Try to access the application as an administrative user and track all the administrative functions.  
* It is possible to access after the log-out?
+
* Is it possible to access administrative functions also if the tester is logged as a user with standard privileges?
* It is possible to access to functions and resources that should be accessible to a user that holds a different role/privilege?  
+
* Is it possible to use these administrative functions as a user with a different role and for whom that action should be denied?
* Try to access to the application as an administrative user and track all the adiministrative functions. It is possible to access to administrative functions also if the tester is logged as a user with standard privileges?
 
* It is possible to use these functionalities for a user with different role and for whom that action should be denied?
 
<br>
 
  
== Black Box testing and example ==
 
'''Testing for Topic X vulnerabilities:''' <br>
 
For example if the application 'AddUser.jsp' is a part of the administrative menu of the application, and it is possible to access request the following URL:
 
* https://www.example.com/admin/addUser.jsp
 
  
+
== How to test ==
The following HTTP request is generated calling the AddUser function:
+
'''Testing for access to administrative functions''' <br>
 +
For example, suppose that the 'AddUser.jsp' function is part of the administrative menu of the application, and it is possible to access it by requesting the following URL:
 +
  https://www.example.com/admin/addUser.jsp
 +
 
 +
 
 +
Then, the following HTTP request is generated when calling the AddUser function:
 +
<pre>
 +
POST /admin/addUser.jsp HTTP/1.1
 +
Host: www.example.com
 +
[other HTTP headers]
  
POST /admin/addUser.jsp HTTP/1.1
+
userID=fakeuser&role=3&group=grp001
Host: www.example.com
+
</pre>
[others HTTP headers]
 
  
userID=fakeuser&ruolo=3&gruppo=grp001
 
  
What if a not adimistrative user try to execute that request?
+
What happens if a non-administrative user tries to execute that request? Will the user be created? If so, can the new user use their privileges?
The user will be created? He can use his privileges?
 
  
  
'''Result Expected:'''<br>
+
'''Testing for access to resources assigned to a different role''' <br>
Execute administrative functions or access to administrative resources as a standard user.
+
For example analyze an application that uses a shared directory to store temporary PDF files for different users. Suppose that documentABC.pdf should be accessible only by the user test1 with roleA. Verify if user test2 with roleB can access that resource.
 
<br><br>
 
<br><br>
== Gray Box testing and example ==  
+
 
'''Testing for Topic X vulnerabilities:'''<br>
+
== Tools==
...<br>
+
* OWASP WebScarab: [[OWASP WebScarab Project]]<br>
'''Result Expected:'''<br>
+
* [https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project OWASP Zed Attack Proxy (ZAP)]
...<br><br>
 
== References ==
 
'''Whitepapers'''<br>
 
...<br>
 
'''Tools'''<br>
 
...<br>
 

Latest revision as of 11:57, 8 August 2014

This article is part of the new OWASP Testing Guide v4.
Back to the OWASP Testing Guide v4 ToC: https://www.owasp.org/index.php/OWASP_Testing_Guide_v4_Table_of_Contents Back to the OWASP Testing Guide Project: https://www.owasp.org/index.php/OWASP_Testing_Project

Summary

This kind of test focuses on verifying how the authorization schema has been implemented for each role or privilege to get access to reserved functions and resources.


For every specific role the tester holds during the assessment, for every function and request that the application executes during the post-authentication phase, it is necessary to verify:

  • Is it possible to access that resource even if the user is not authenticated?
  • Is it possible to access that resource after the log-out?
  • Is it possible to access functions and resources that should be accessible to a user that holds a different role or privilege?


Try to access the application as an administrative user and track all the administrative functions.

  • Is it possible to access administrative functions also if the tester is logged as a user with standard privileges?
  • Is it possible to use these administrative functions as a user with a different role and for whom that action should be denied?


How to test

Testing for access to administrative functions
For example, suppose that the 'AddUser.jsp' function is part of the administrative menu of the application, and it is possible to access it by requesting the following URL:

 https://www.example.com/admin/addUser.jsp 


Then, the following HTTP request is generated when calling the AddUser function:

POST /admin/addUser.jsp HTTP/1.1
Host: www.example.com
[other HTTP headers]

userID=fakeuser&role=3&group=grp001


What happens if a non-administrative user tries to execute that request? Will the user be created? If so, can the new user use their privileges?


Testing for access to resources assigned to a different role
For example analyze an application that uses a shared directory to store temporary PDF files for different users. Suppose that documentABC.pdf should be accessible only by the user test1 with roleA. Verify if user test2 with roleB can access that resource.

Tools