All right.
Now on our application I'm already logged in as my testing at test dot com user.
So if you're not logged in.
Go ahead and do so now.
We're going to abuse one feature and I do encourage you to come in here and look at all the different
broken access controls that they have and just kind of get an understanding of all the different ways
that you can manipulate things here OK.
And gain access to places that you shouldn't.
But the one that we're gonna be looking at is putting feedback in another user's name.
This one I showed to you.
I'm going to explain to you why I like this one because it's a nifty little trick you're going to see
here.
So let's go ahead and go to account or actually let's go over here and go to customer feedback so our
goal is to leave feedback in another user's name.
So I'm going to say mean thing you're terrible.
I'm going to make this person look bad.
I'm going to give a one star rating.
Let's go ahead and solve the captcha using our pen dos.
Right.
So six minus five is one plus nine is 10.
And if we submit this we just submit it as ourselves.
Well we have to understand what's going on here.
So what we can do is we can right click on this and say inspect element.
Now why do I love this.
And this might be hard to see.
So just try to follow along.
But I love this here because this is so realistic about as what Beth is about to happen.
I'm so excited I'm stuttering.
So with what's about to happen here a lot of times all log into an application or a web page even like
big name vendors have I've seen this on where you go in there and you go and there's like a username
and password field or you know what's your what's your security answer and you see it.
And it's like All Stars right.
Well something I like to do is I like to I like to inspect that element and see if it's holding the
value there but it's just hiding it or masking it from us which is exactly what's happening here.
So we inspected the element and you should be brought somewhere here like this div class.
If we look up just a bit there's this input user I.D. right here and you could see that the text is
actually hidden.
So it says hidden right here.
I want to go ahead and just delete that and see you what is going on here and what text is actually
hidden.
And you see it says 18 and the user I.D. of 18 they're just hiding this.
This is not a good way to do this right.
This is terrible but this honestly this is so true is you have this password field just like this where
it's all blank out you right click on it and it says hidden you just set it to you delete it or you
say false or you know you want to show these passwords or it'll say type feel type equals password and
you say feel type equals text and guess what it will show everything in clear text.
So this is a form of bypassing broken access control here or bypassing access control.
So we are user I.D. 18 in this application.
I'm just gonna go ahead and try to pick user I.D. number one which should be probably an admin or the
first user created if they're incrementing these in numerical order.
So let's go ahead and submit that and you can see it says Forge feedback.
We have done it.
So we just posted feedback in another user's name that's broken access control.
We weren't supposed to do that.
Another example is say we wanted to you know I think it's administrator or administration or something
along those lines here if we wanted to try to navigate that page.
Look it had it for a second and it blocked us.
So we need to try to abuse all the features here that we possibly can.
So keep these things in mind you know read up on this stuff try to understand what's going on and know
that broken access control is a huge catch all for a lot of different attacks but understanding what
it is for an interview process is gonna be super helpful.
So that's it for this.
We're gonna go ahead and move on to number six which is security.
Miss configurations.