Systematically tests web applications and APIs for broken access control (OWASP A01:2021), including privilege escalation, missing function-level checks, insecure direct object references, and multi-tenant data leakage, using Burp Suite with the Authorize extension. Use during authorized penetration

Testing for Broken Access Control When to Use During authorized penetration tests as the primary assessment for OWASP A01:2021 Broken Access Control When evaluating role based access control (RBAC) implementations across all application endpoints For testing multi tenant applications where users in one organization should not access another's data When assessing API endpoints for missing or inconsistent authorization checks During security audits where privilege escalation and unauthorized access are primary concerns Prerequisites Authorization : Written penetration testing agreement for the target Burp Suite Professional : With Authorize extension for automated access control testing Multiple test accounts : Accounts at each role level (admin, manager, user, guest) Application role matrix : Documentation of what each role should and should not access curl/httpie : For manual endpoint testing with different authentication contexts ffuf : For discovering hidden endpoints that may lack access controls Workflow Step 1: Map All Endpoints and Create Access Control Matrix Document every endpoint and the expected access level for each role. Step 2: Configure Automated Access Control Testing Set up Burp Authorize extension for parallel role based testing. Step 3: Test Vertical Privilege Escalation Attempt to access higher privilege functionality with lower privilege accounts. Step 4: Test Horizontal Privilege Escalation Verify that users cannot access resources belonging to other users at the same privilege level. Step 5: Test Function Level Access Control Verify that specific functions enforce authorization properly. Step 6: Test Multi Tenant Isolation Verify that tenant boundaries are enforced in multi tenant applications. Key Concepts Concept Description Vertical Privilege Escalation Lower privilege user accessing higher privilege functionality (user admin) Horizontal Privilege Escalation User accessing another user's resources at the same privilege level Function Level Access Control Authorization checks on specific features/functions regardless of URL RBAC Role Based Access Control permissions assigned to roles, roles assigned to users ABAC Attribute Based Access Control permissions based on user/resource/environment attributes Multi Tenant Isolation Ensuring data and functionality separation between different organizations/tenants Insecure Direct Object Reference Accessing objects by manipulating identifiers without authorization checks Missing Function Level Check Endpoint exists but does not verify the caller has permission to invoke it Tools & Systems Tool Purpose Burp Suite Professional Request interception and role based testing Authorize (Burp Extension) Automated access control testing across sessions AutoRepeater (Burp Extension) Automatically replays requests with different auth contexts Postman API testing with environment switching between roles ffuf Discovering hidden endpoints that may lack access controls OWASP ZAP Access control testing with context aware scanning Common Scenarios Scenario 1: Admin Panel Without Auth Check The /admin/dashboard endpoint returns the admin panel when accessed with a regular user's session token. The front end hides the admin menu, but the back end does not enforce role checks. Scenario 2: API Endpoint Missing Authorization The DELETE /api/users/{id} endpoint checks for authentication (valid token) but not authorization (admin role). Any authenticated user can delete any other user's account. Scenario 3: Tenant Data Leakage A SaaS application uses tenant id in API request headers. Changing the X Tenant ID header to another tenant's ID returns their data, bypassing tenant isolation. Scenario 4: Mass Assignment Role Escalation The user profile update endpoint at PUT /api/users/{id} accepts a role field in the JSON body. Submitting "role":"admin" alongside a profile update elevates the user to administrator. Output Format

testing-for-broken-access-control