In this blog post I would like to talk about a technique which can be
used to find privilege escalation in web applications.
Privilege escalation occurs when a user gets access to more resources or functionality than they are normally allowed, and such elevation or changes should have been prevented by the application. This is usually caused by a flaw in the application. The result is that the application performs actions with more privileges than those intended by the developer or system administrator.
We refer to vertical privilege escalation when a flaw allows a lower privileged user to access and/or modify data which should only be accessible to higher privileged users (administrators) and to horizontal escalation when it is possible to access resources granted to a similarly configured account (different user).
Privilege escalation occurs when a user gets access to more resources or functionality than they are normally allowed, and such elevation or changes should have been prevented by the application. This is usually caused by a flaw in the application. The result is that the application performs actions with more privileges than those intended by the developer or system administrator.
We refer to vertical privilege escalation when a flaw allows a lower privileged user to access and/or modify data which should only be accessible to higher privileged users (administrators) and to horizontal escalation when it is possible to access resources granted to a similarly configured account (different user).
For this demo I will use Hackazon vulnerable web app VM from Rapid7.
First create a new user in Hackazon named “User1” and create a new project in Burp with the same name. Login with User1’s credentials, browse around the site and then right click on the target and choose “Spider this host”. When the spidering is done, click on Logout and close Burp.
Then open Burp again and create a new project named admin.
Go ahead and login to the web app as admin/hackazon. Repeat the previous steps to spider the site. After the spidering is finished, right click on the target and choose “Compare site maps” tool.
When the comparison is done we can see both site maps and visually identify the differences between the two with the help of color coding.
Copy the order’s URL from Burp, login as User1 to the web app and paste the order URL in the browser.
Also we check that User1 does not have any orders placed.
We can now see admin’s order and confirm that the web app is vulnerable.
