Building an Proper Access control Model is hard, The consequences of a flawed access control scheme can be devastating. In addition to viewing unauthorized content, an attacker might be able to change or delete content, perform unauthorized functions, or even take over site administration. We make sure to test your Access control for all kind of escalations that are possible, Plus out f uses their specially crafted (Forward | Backward) Approached to test your Access control Model.
Who is it for?
Role Based Testing service is a specific service for SaaS business which are using any Role-based or Access-Control technologies in their applications. Application which allows their customers to invite new members to their tenants/orginisation with limited permission are our primary customers on this service.
We at snapsec have accepted a challenge and we have come up with an proper methodology to test access control model in a modern way, our methodology covers all scenarios that can lead privilege escalation within the target system and provides us with the full coverage of the target model, To do that we designed different techniques for each kind of privilege escation scenario that can arise within the system.
WHAT WE TEST?
With our experience of several years of testing and analyzing BACM(broken access control models), we have figured out several effective techniques to test Access Control models.
Our main three effective techniques/approaches are as under:
In the forward approach strategy, a user must be invited with only one permission (suppose it is the first green-coloured permission) and Then the invited user with only one permission will try to access all other restricted API endpoints in sequential order
Backward Approach: In the backward approach, the user should be granted all the permissions in the model except one permission and we will try to access the respective API endpoint of the devoid permission.
Mixed Approach: In the mixed approach a user must be invited with a set of mixed permissions from the permission list and then he/she will try to access the corresponding API endpoints of restricted roles.
Read More about our methodology here Attacking Access Control Models in Modern Web Application
- Identify privilege escalation in your web-app/Api
- Get full insights on your access control models
- Identify permission overrides in your web-app/Api
- Customized reports will help you understand the privileges set around different roles in the application.
- Understand different roles and the damage that can be done when the privilege escalation happens