‫Authorization is the function of specifying access rights and privileges to resources more formally
‫to authorize is to define and access policy.
‫For example, human resources staff is normally authorized to access employee records.
‫And this policy is usually formalized as access control rules during operation.
‫The system uses the access control rules to decide whether authentication shall be granted or rejected
‫in the application.
‫What resources the users will be able to use is determined by the authorization process.
‫There might be different roles in users in the application, and every role has its own access privileges.
‫We should identify each user or role, find out the permissions given to them and try to push each user
‫for unauthorized transactions.
‫We try to find the weaknesses and vulnerabilities of the applications authorization mechanism and escalate
‫our privileges when the application does not control parameters coming from the user, you can process
‫some unauthorized operations.
‫The scenario displayed on a slide is a true story.
‫The user has only view permission on the product when she wants to view a product.
‫The URL is prepared as seen on the slide by the application.
‫Now there is a parameter named action and its value is view.
‫What if we change the value of the parameter as delete?
‫Privilege escalation is the act of exploiting a bug design flaw or configuration oversight in the application
‫in order to gain elevated access to resources that are normally protected from an application or user.
‫The result is that a user with more privileges than intended by the application can perform unauthorized
‫actions if a normal user accesses functions or content reserved for other normal users.
‫It's called horizontal privilege escalation.
‫For example, internet banking user A accesses the internet bank account of User B if a lower privilege
‫user accesses functions or content reserved for higher privilege users.
‫That's called vertical privilege escalation.
‫For example, internet banking user accesses site administrative functions.
‫There are two real world privilege escalation examples in this slide and the first example the message
‫sent to a user has an ID number.
‫Is it a random number, or is it a number increasing regularly?
‫Here, the next message has the next numbers ID.
‫For instance, if the message ideas well, the next message ID will be 13.
‫Changing the ID, we are able to read a message which is for anyone else.
‫No matter what the ID number is, the application should perform and access control in each attempt.
‫Now in the second example, there is a hidden field with an aim of list underscore admin and the value
‫of F, assuming that the F is for falls changing it to T for true, we get the admin role in that application
‫path.
‫Traversal attack is also known as Dot Dot Slash Directory, traversal, directory climbing and backtracking.
‫This attack aims to access files and directories that are stored outside of the Webroot folder by manipulating
‫variables that reference files with dot dot slash sequences and its variations, or by using absolute
‫file path.
‫It may be possible to access arbitrary files in directories stored on the file system, including application,
‫source code or configuration and critical system file.
‫It should be noted that access to these files is limited by system operational access control.
‫So let's see the attack in a real world example.
‫While examining the application, we saw an attribute value pair with the attribute name of template.
‫After just a few tries, we realized that there are different templates for the website, and the application
‫decides which one to use.
‫In the source code, it's seen that the value of the template attribute of the cookie is used as the
‫file name directly change the template file name, but a few dot dot slash followed by cetera and password
‫folders.
‫Now here there are two things we should note.
‫First, we assume that the server hosting the application is a Linux machine.
‫Even though we don't know the operating system of the server, we can find it easily after a few attempts
‫in this attack.
‫The second dot dot slash brings you one folder outer.
‫We try to reach the root folder first, then go to the, et cetera, slash password file.
‫Redundant dot dot slashes are harmless.
‫Which means if you send dot dot slash after you reach the root, no error is given.
‫So you can put dot dot slashes in as many times as you want.
‫But you see the response of the application contains password file content as well.