Let's talk.
Broken access control which is a number five on our list now broken access control is kind of like this
big catch all there's so many different vulnerabilities that can fall into this and you can see.
Scroll down here and you can see there's quite a bit.
What you need to know about broken access control is you really should know what it is at a high level.
And that means that a user gets access to somewhere they shouldn't.
It's as simple as that.
Save for example that we have here a page and there is an admin section and we're not an ATM user.
We should not be able to access that admin section right.
That would be broken access control if a regular user like me is able to access the then panel of an
admin or another one is maybe something like I d equals and then we say something like five and we're
viewing our record or our page number of five and we see all of our details and data.
Well we could reference a different object maybe six could be a different user I.D. or a different page
and we see that but we're not supposed to see it right.
That's a vulnerability that's broken access control.
So there's so many different ways that we can exploit this and I'm going to show you one by want you
to know what I want you to take away from this is the high level of what you're looking for in that
is to be able to bypass access.
We could do probably hours of material on just this concept but you are looking in thinking like an
attacker right.
So this is why specifically why we have and we're talking video.
We have those three tiers the UN authenticated authenticated and admin.
Right.
You want to know if you can access admin areas or even other user areas from an account you want to
break that access.
That's how you find these vulnerabilities.
So there's a lot of different ways to do this.
What I'm describing here is good examples you can like it says you know access a Web page like we just
talked about or what I'm showing you you know going from five to six.
That's what's called an eye door or an insecure Direct Object reference.
We shouldn't be able to see somebody else's information unless we're meant to see it.
OK.
So I want you to read over this page.
I want you to get familiar with this kind of understand how to prevent.
So everything's a little bit different depending on the vulnerability and how you should prevent it
but what it boils down to is that you need to ensure that your users do not have access to anything
that they should not.
Right.
So let's go ahead and take a look in the next video an example.
But I want you to read over this gif familiar with it.
Be able to understand in an interview you know what you're after.
If somebody says Hey can you explain broken access control to me.
You say Yeah you know here's an example or here's another example.
So read through this for sure and then again as always I'll post the reference down in the reference
below for this Web site.
So I'll catch you over the next video and we take a look at something that I find quite often in web
apps.