Class Central is learner-supported. When you buy through links on our site, we may earn an affiliate commission.

A01: Broken Access Control

Go to class Write review

Overview

This course addresses flaws where improper enforcement of access restrictions allows unauthorized users to access or modify sensitive data or functionality, such as paste snippets or administrative pages, due to unverified input or missing role checks.

Syllabus

Unit 1: Introduction to Java Security

Exploring the Pastebin Application
Testing JWT Authentication with Curl

Unit 2: Securing Account Parameters

Exploiting Unverified Account Parameters
Securing API Endpoint with JWT Authentication
Implementing User Authorization with JWT
Secure Account Info Endpoint by Removing ID Parameter

Unit 3: Preventing Forced Browsing

Demonstrating Forced Browsing on Admin Endpoint
Implementing Role-Based Admin Authorization
Logging Unauthorized Access Attempts

Unit 4: Preventing Privilege Escalation

Exploiting Privilege Escalation Vulnerability
Securing User Profile Endpoint with JWT Authentication
Fixing the Privilege Escalation Vulnerability

Unit 5: Protecting Sensitive User Data

Exploiting Vulnerable Endpoints to Expose Sensitive User Data
Implement Password Hashing with BCrypt
Secure User Details Response
Masking Sensitive Payment Data

Reviews

Start your review of A01: Broken Access Control