WebGoat系列のAccess Control Flaws(访问控制缺陷)

Using an Access Control Matrix

用户权限：

　　　　Moe--> public share

　　　　Larry--> Time Card Entry，Performance Review，Time Card Approval，Account Manager

　　　　Curly--> public share,Performance Review，Time Card Approval

　　　　Shemp->Site Manager,Account Manager

Bypass a Path Based Access Control Scheme

利用burp抓包修改访问文件路径

forward之后

LAB: Role Based Access Control

Stage 1: Bypass Business Layer Access Control

 这真的是CTF里才会出现的题型

 

Stage 2: Add Business Layer Access Control

Stage 3: Bypass Data Layer Access Control

一样的道理，拦包之后改一下用户的ID就可以查看其他人的数据了

Stage 4: Add Data Layer Access Control

Remote Admin Access