Class Central is learner-supported. When you buy through links on our site, we may earn an affiliate commission.

A01: Broken Access Control

Go to class Write review

Overview

This course addresses flaws where improper enforcement of access restrictions allows unauthorized users to access or modify sensitive data or functionality, such as paste snippets or administrative pages, due to unverified input or missing role checks.

Syllabus

Unit 1: Introduction to OWASP and Course Overview

Getting Started
Sending Requests with Curl

Unit 2: Unverified Account Parameter in API Endpoints

Exploiting Unverified Account Parameters
Secure Your API with JWT
Enforce User Authorization
Removing the ID Parameter
Centralize JWT Authentication Middleware

Unit 3: Forced Browsing of Admin Pages

Exploit Vulnerable Admin Endpoint
Secure the Admin Endpoint
Log Unauthorized Access Attempts

Unit 4: Elevating User Privilege

Privilege Escalation in Action
Removing URL Parameters with JWT
Restrict Unauthorized Role Changes

Unit 5: Exposing Sensitive User Data

Exposing Sensitive Unprotected Data
Hashing Passwords with Bcrypt
Secure User Data in API Responses
Secure Sensitive Payment Information

Reviews

Start your review of A01: Broken Access Control