Exploiting API Authorization

Question 1

What is Broken Object Level Authorization?

Answer 1

It’s a authorization vulnerability that happens when a user can access other user’s resources.

Question 2

What are the three needed aspects for a successful BOLA exploitation?

Answer 2

1. Resource ID.
2. Requests that access resources.
3. Missing or flawed access controls.

Question 3

What is the A-B testing technique? Explain its steps.

Answer 3

It’s a very effective way for testing and finding authorization weaknesses. The steps to perform it are:
1. Create an UserA account
2. Use the API and find requests that involve resource IDs
3. Document this requests and send it to BurpSuite’s repeater tab
4. Create an UserB account
5. Replace the UserA token by UserB’s token and send the requests to see if you can access UserA’s resources while logged in as UserB

Question 4

True or false: When hunting for BFLA you should focus only on GET requests.

Answer 4

False. Although you should look for GET requests that have parameters, you should focus on POST, PUT and DELETE request because these methods are usually the ones used to alter resources.

Question 5

What is BFLA?

Answer 5

Broken Function Level Authorization is an authorization vulnerability that happens when a user can perform actions that affect other user’s resources.

Question 6

What are the two types of requests vulnerable to BFLA?

Answer 6

Lateral and escalated. Lateral is a request that performs actions of users that have the same level of privilege. Escalated is a request that performs actions that are of a higher role or level of privilege.

Question 7

What are the three needed aspects that a request must have to be vulnerable to BFLA?

Answer 7

1. Resource ID.
2. Perform authorized actions such as altering a resource.
3. Missing or flawed access controls.

Question 8

Why do we use A-B-A testing when looking for BFLA?

Answer 8

To create a stronger PoC.

Question 9

Which of the following requests would be the most interesting from an authorization testing perspective? Why?
a) GET /user/account
b) GET /user/account/details?id=11
c) GET /user/dashboard
d) POST /account/dashboard

Answer 9

Letter b. Because it involves a resource ID, in this case the user id.