Broken Access Control | Complete Guide

Рет қаралды 39,568

Күн бұрын

In this video, we cover the theory behind Access Control vulnerabilities, how to find these types of vulnerabilities from both a white box and black box perspective, how to exploit them and how to prevent them.
▬ ✨ Support Me ✨ ▬▬▬▬▬▬▬▬▬▬
Buy my course: bit.ly/30LWAtE
▬ 📖 Contents of this video 📖 ▬▬▬▬▬▬▬▬▬▬
00:00 - Introduction
00:28 - Web Security Academy Course (bit.ly/30LWAtE)
01:39 - Agenda
02:25 - What is Broken Access Control?
22:50 - How to Find Access Control Vulnerabilities?
30:29 - How to Exploit Access Control Vulnerabilities?
34:40 - How to Prevent Access Control Vulnerabilities?
39:00 - Resources
39:15 - Thank You
▬ 🔗 Links 🔗 ▬▬▬▬▬▬▬▬▬▬
Video slides: github.com/rkhal101/Web-Secur...
Web Security Academy OS Command Injection: portswigger.net/web-security/...
Cross-Origin Resource Sharing Playlist: • Cross-Origin Resource ...
Rana's Twitter account: / rana__khalil
Hacker Icons made by Freepik: www.freepik.com

Пікірлер: 53

@RanaKhalil101 Жыл бұрын

📚📚 Don't want to wait for the weekly release schedule to gain access to all the videos and want to be added to a discord server where you can ask questions? Make sure to sign up to my course: bit.ly/30LWAtE

@Stephanus21 Жыл бұрын

I know about you for a while now, just started with your videos , but I have to say you are one amazing teacher. Your soft voice and deep knowledge of the subject makes it a lot easier for me. Thank you so much. I will definitely buy your courses.

@user-gn7hh3zw6n 5 ай бұрын

This is gold! I've understood many concepts and solved 40+ labs on the academy website, thanks to your content. I think I won't miss any single video on this channel! Wish you all the best ❤❤❤

@1990shahid Жыл бұрын

Thank you for the work you've put into making this 🙏🏾

@hdammotowa9695 Жыл бұрын

This is my first video, I understood everything and I can't wait for the practical explanation شكرا

@gangsternerd8419 Жыл бұрын

Nobody teach as good as you, you make this thing easy to learn thanks Rhana❤

@maakthon5551 Жыл бұрын

Simple and forward , Thanks!

@MFoster392 Жыл бұрын

I love your videos they're so helpful :)

@Axel-rs3cg 9 ай бұрын

really well explained ✌🏽

@snowden-IT Жыл бұрын

يعجبني حماسك والمثابرة شكرا على هذا الشرح

@MrBlackhats Жыл бұрын

yes make plz a bonus video about this topic!! thanks

@sintayehutsegayeworku1855 Жыл бұрын

Am totally new for IT field, am accountant in the banking industry. But now am learning computer science to be a hacker. I first see you in "David Bombal" KZfaq channel interview and now am your follower. Thank You for Doing This (I really want to buy your course but I can't I am in Ethiopia.

@xbaleks4609 Жыл бұрын

Chokrane Bzaff ! Thank You so much !

@balasubramaniamgopal8437 9 ай бұрын

Brilliant !!

@sintayehutsegayeworku1855 Жыл бұрын

Thank You for doing this

@css2165 Жыл бұрын

great video. will you upload ctf examples?

@gajendraupadhyay6740 Жыл бұрын

Its really good...👍👍keep it up..

@shayansec Жыл бұрын

Great vid...Just revised this vuln.

@Davidgonzalez-tp4ew Жыл бұрын

La explicación es muy clara, excelente video 🌄🌠😉🇨🇴🇨🇴

@ahmedmouad344 Жыл бұрын

Finally Ur back again and on time cause i finish my finals soon 🥰

@kanimani8226 Жыл бұрын

Rana I love your content hope you all best What about the OSWE , and your progress ? Have you size it ?

@riteshasthana7824 4 ай бұрын

Thank you mam for such informative videos

@Love-yv1fc Жыл бұрын

Thank you❤

@brudora3096 Жыл бұрын

Thanks those videos ❤❤

@lifeofsq5653 7 ай бұрын

Hi Rana, Want to see how you are using Autorize in burpsuite to check for access contorl bypass

@mohamedmahrous9500 Жыл бұрын

thank you ❤❤

@Donut-qt9mr 10 ай бұрын

thanksyou for the valueable content

@paulojr1384 Жыл бұрын

Thank you Hana

@mohmino4532 5 ай бұрын

in fact is that I find it difficult to understand everything cuz my English skills are not perfect, but I do my best, and u still the number one to me tho .. so thx so much ma teacher تحية اليك من الجزائر .

@FaultyGlitch 11 ай бұрын

Thank you

@user-rs3nv6yu7s Жыл бұрын

Great job, Thank you from 🇵🇰

@rahulgogra7089 10 ай бұрын

please make a video on the extension.🙏

@suyunovjasurbek Ай бұрын

i like you'r vedios. thanks Mrs

@amin_alaa 11 ай бұрын

thanks

@tnt7298 Жыл бұрын

Could u upload whole videos which comes under "Access Control vulnerabilities"?

@css2165 Жыл бұрын

perfection

@chowdhurytowhidahmed7780 Жыл бұрын

Love from by heart

@nibrasmuhammed5105 Жыл бұрын

@rana khalil. 19:58 on this video, it is not vulnerable at all. I will tell the implementations. 1) Every request comes through a middleware which checks the jwt. if the jwt is altered, they will never get this function. since we are getting the id from jwt, we can ensure that the request comes from the owner of the the account. if someone altered id field of jwt, middleware return the request. hope you get it.

@UpTheStack Жыл бұрын

No. How does authentication middleware prevents attacker to exploit this piece of code? Even if I am authenticated as user1 and order with id 2 (for example) was created by user2, I still can make a DELETE request to /orders/2/ and delete that order, because there was no access control in that piece of code

@nibrasmuhammed5105 Жыл бұрын

@@UpTheStack talking about IDOR?