首页 > 代码库 > WebGoat系列のAccess Control Flaws(访问控制缺陷)

WebGoat系列のAccess Control Flaws(访问控制缺陷)

Using an Access Control Matrix

用户权限:

    Moe--> public share

    Larry--> Time Card Entry,Performance Review,Time Card Approval,Account Manager

    Curly--> public share,Performance Review,Time Card Approval

    Shemp->Site Manager,Account Manager

Bypass a Path Based Access Control Scheme

利用burp抓包修改访问文件路径

技术分享

forward之后

技术分享

LAB: Role Based Access Control

Stage 1: Bypass Business Layer Access Control

 这真的是CTF里才会出现的题型

 

技术分享

技术分享

Stage 2: Add Business Layer Access Control

Stage 3: Bypass Data Layer Access Control

一样的道理,拦包之后改一下用户的ID就可以查看其他人的数据了

技术分享

技术分享

Stage 4: Add Data Layer Access Control

Remote Admin Access

 

WebGoat系列のAccess Control Flaws(访问控制缺陷)