-
Book Overview & Buying
-
Table Of Contents
CompTIA PenTest+ Study Guide
By :
We’ve explored injection vulnerabilities that allow an attacker to send code to backend systems and authentication vulnerabilities that allow an attacker to assume the identity of a legitimate user. Let’s now take a look at some authorization vulnerabilities that allow an attacker to exceed the level of access for which they are authorized.
In some cases, web developers design an application to directly retrieve information from a database based upon an argument provided by the user in either a query string or a POST request. For example, this query string might be used to retrieve a document from a document management system:
https://www.mycompany.com/getDocument.php?documentID=1842
There is nothing wrong with this approach, as long as the application also implements other authorization mechanisms. The application is still responsible for ensuring that the user is properly authenticated and is...
Change the font size
Change margin width
Change background colour