What Broken Access Control Is

Broken Access Control is the category where the server fails to enforce what each principal may read, write, create, delete, or invoke. The attacker’s goal is not “break crypto” — it is to act as a privileged or peer user without earning that policy. Classic shapes: skip role checks on /admin, change a userId in a URL, replay a privileged API from a low-priv session, force the server to request internal URLs (SSRF, now called out under A01:2025), or abuse CORS / forced browsing to reach surfaces that should stay closed. Finding language: “Endpoint accepts authenticated caller but does not assert ownership, tenant, or role before acting.” Fix language: “Deny by default; enforce server-side policy on every object and function; test cross-user and cross-role.” Client UI hiding a button is not access control.

sudo apt install curl

curl -v http://localhost:8080/admin
curl -v http://localhost:8080/api/users/2 -H 'Cookie: session=user1_token'

curl http://localhost:8080/api/orders/1001
curl http://localhost:8080/api/orders/1002  # should be denied if not your order

PowerShell

Invoke-WebRequest -Uri 'http://localhost:8080/admin' -Method GET
Invoke-WebRequest -Uri 'http://localhost:8080/api/users/2' -Headers @{Cookie='session=user1_token'}

Horizontal failure: user A reads or mutates user B’s invoice, message, or profile at the same privilege tier. Vertical failure: a standard user reaches an admin export, feature flag flip, or privileged RPC. Both are A01. Attackers prefer boring tools — curl, a browser, a proxy that edits one parameter — because the bug is missing checks, not exotic payloads. CSRF sits in the access-abuse neighborhood: the browser sends the victim’s cookies to a state-changing endpoint the victim did not intend. Treat it as “actions without intentional authorization,” still on apps YOU own for demos. This lesson names it; later modules deepen related families without turning you into a foreign-host hunter.

Server-Side Request Forgery is an access-control failure of a different shape: the server’s network position becomes the attacker’s client. The app fetches a URL the caller influenced, reaching localhost, internal APIs, or link-local metadata the attacker cannot hit directly. That is still “acting beyond authorized reach.” Lesson 3 deepens SSRF with allowlist thinking — never real AWS metadata PoCs against accounts you do not own. Map your mental model: IDOR = object policy missing; forced browsing = function policy missing; SSRF = server-as-proxy beyond intended destinations. One category, three common report titles.

Shipping list for A01: centralize authorization; deny by default; resolve the object then assert owner/tenant/role; never trust client-supplied roles or “isAdmin” flags; prefer server-side session identity over body userId; rate-limit and log denials; add automated tests where user A cannot read B and user cannot hit admin. Random UUIDs slow guessing — they do not replace checks. Report hygiene: describe the missing check and the impact class (confidentiality, integrity, privilege). Do not paste exploit kits. Do not aim PoCs at hosts outside written RoE. Cyberlium labs stay on loopback and files under $HOME/cyberlium-lab.

Date (UTC). A01 = Broken Access Control (OWASP Top 10:2025). Authn ≠ authz. Horizontal vs vertical one line each. SSRF named as server-fetch access failure. Identify curl of http://192.168.0.1/ (or SAFE 127.0.0.1:8765 if that IP is a router). Ship: deny-by-default + server policy. Ethics: NEVER foreign SaaS IDOR; NEVER unauthorized cloud metadata; NEVER classmate APIs; NEVER hydra/nmap the LAN. Path: $HOME/cyberlium-lab/a01-bac-literacy-notes.txt, chmod 600. Legal: original Cyberlium — not official OWASP certification.

Create the notes file now so Lesson 2 has a place to attach IDOR observations. Two terminals if you start the teaching server: identify first, then curl SAFE. The helper does not scan the internet.

You now treat Broken Access Control (OWASP Top 10:2025 A01) as missing policy after identity — horizontal, vertical, and server-fetch shapes — with an identified demo asset and locked local notes. This is original Cyberlium teaching, not official OWASP certification. Next — IDOR and Object-Level Failures — ownership checks on YOUR lab.