Quiz — Broken Access Control
10 APPLY on A01: authz, IDOR, SSRF-as-access, demo http://192.168.0.1/ ethics.
Broken Access Control — Module Quiz
Ten APPLY items on OWASP Top 10:2025 A01 sentences this module refused to collapse: authentication is not authorization; horizontal IDOR is object policy missing; vertical is function/role policy missing; UI hiding is not a control; UUIDs are not a substitute for checks; SSRF is server-fetch beyond intended destinations (allowlist, never unauthorized cloud metadata fetches). Foreign SaaS enumeration, real AWS metadata recipes, BeEF/cookie kits, binding labs to 0.0.0.0 for the dorm, and treating Cyberlium XP as official OWASP certification are all failing answers. Wrong answers still teach. Next: Defaults Debug and Open Surfaces (A02).
APPLY: A classmate finishes A01 and wants to walk invoice ids on a public SaaS “because Broken Access Control is #1.” What do you do?
APPLY: True or False: A valid session cookie means every API route is authorized for that user.
APPLY: alice GETs /invoices/1043 and receives bob’s invoice. Name the failure and the fix direction.
APPLY: True or False: Switching to UUIDs fully remediates IDOR without ownership checks.
APPLY: A low-priv user hits /admin/export and gets a dump. What A01 shape is that?
APPLY: An app fetches user-supplied preview URLs and echoes bodies. What is the A01:2025 framing, and what is out?
APPLY: True or False: Hiding the Admin menu in the SPA fully remediates Broken Access Control.
APPLY: curl http://192.168.0.1/ shows a TP-Link/Netgear “Router Admin” login. What do you do?
APPLY: A blog posts cloud metadata SSRF one-liners “for OWASP A01.” What does Cyberlium tell you?
APPLY: You finish A01. Which pairing is true, and what opens next?