Week 03 · Access Control ULTIMATE · 7 days × 180 min

Two accounts. Every object. Highest bounty-per-effort.

BOLA → BFLA → 403 bypass → traversal → API excessive-data → chaining + CVSS. Autorize always on. Numeric today, UUID analysis tomorrow, impact boundary always.

A/B replay habitAutorize onticks bbv2-03
🎉 Week complete — all boxes ticked. Move to Week 04.
Real 180 min · A owns, B steals

  1. 0:00–0:15 BOLA vs BFLA vs mass-assignment + replay harness sketch

    Write defs, then read WSTG ATHZ-04 IDOR § test objectives + how-to-test ONLY + HackTricks IDOR § Identifying Potential IDORs ONLY. Sketch harness: A-cookie jar, B-cookie jar, Repeater tabs labeled.

    WSTG: ATHZ-04HackTricks: IDOR identify
    Why this matters ▼

    What it is

    BOLA = horizontal (A→B same role), BFLA = vertical (user→admin), mass-assignment = extra field. Harness = two profiles + Autorize.

    Done-when

    Defs + harness sketched.

  2. 0:15–1:05 PortSwigger labs 1–4 in order: unprotected function → role-cookie → user-id → chat-log IDOR

    Do lab-unprotected-admin-functionality (/robots→/admin→delete carlos) + lab-user-role-controlled-by-request-parameter (Admin=false→true) + lab-user-id-controlled-by-request-parameter (id swap→API key) + lab-insecure-direct-object-references (chat static URL→carlos pwd) — IN ORDER, no skipping. Autorize ON (Enforcement Detector, Intercept=false).

    Lab 1: unprotected functionLab 2: role cookieLab 3: user-id swapLab 4: chat IDORAutorize setup
    Why this matters ▼

    YT

    Search portswigger access control lab walkthrough (@RanaKhalil) + IDOR BOLA two account method (@InsiderPhD/@NahamSec).

    Done-when

    4 labs solved + Autorize diffs (status/length) screenshotted.

  3. 1:05–2:00 H1 patterns: Pornhub delete + Starbucks balance + numeric vs UUID

    Read H1 #380410 (photo_id/album delete by B session) + #858662/#766437 (recipient_id/balance diff) — request-swap + impact ONLY + H1 #2586584 (UpdateProfile numeric→email leak) + #2633771 (base64 gid brute-force) — key-type lesson ONLY. Extract object-key pattern per case.

    H1 #380410 galleryH1 #858662 balanceH1 #2586584 numericH1 #2633771 gid
    Why this matters ▼

    Pattern

    Numeric = 123→124. Encoded/UUID = decode + entropy analysis (UUIDv1 timestamp vs v4 random). Impact boundary: read vs write vs delete vs PII.

    Done-when

    4 patterns with key-type + swap + impact in notes.

  4. 2:00–2:35 IDOR checklist: numeric/encoded/UUID/body-key + PATT quick-tamper

    Write checklist per HackTricks IDOR § Quick manual tampering ONLY + PATT IDOR two-account setup rows ONLY. Columns: key location (URL/body/cookie/GraphQL) × predictability × impact.

    HackTricks: quick tamperPATT: IDOR setupAll labs: access-control filterCommunity: all-labs solutions (attempt first)
    Why this matters ▼

    Done-when

    Checklist saved, reusable Week 07/10.

  5. 2:35–3:00 BOLA vs BFLA test + impact boundary + gaps

    Recite with lab example each. Log impact boundary for one lab (read/PII/delete). Triage gaps.

    OWASP API Top 10
    Why this matters ▼

    Done-when

    Recited + boundary logged + gaps assigned.

Hunter mindset: Two accounts = superpower.
Real 180 min · why does client send identity at all?

  1. 0:00–0:15 WSTG ATHZ-02/03 + role/tenant param mental model

    Read WSTG ATHZ-02 bypassing schema + ATHZ-03 privilege escalation § objectives ONLY. List params: role/isAdmin/tenant_id/groupId.

    WSTG: ATHZ-02WSTG: ATHZ-03
    Why this matters ▼

    What it is

    Vertical = low→high. Mass-assignment = server binds extra JSON fields (role:true) without allowlist.

    Done-when

    Param list + defs cold.

  2. 0:15–1:05 role=admin / tenant_id injection + read→write mirror (lab)

    On lab: add "role":"admin", tenant_id swap, _method=PUT override on write requests. Mirror every read-response field into writes. PortSwigger lab-url-based-access-control-can-be-circumvented (X-Original-URL: /admin) as warmup. PATT mass-assignment rows ONLY.

    Lab: X-Original-URLPATT: mass-assignment
    Why this matters ▼

    X

    Search mass assignment exploit + IDOR BOLA bounty min_faves:200.

    Done-when

    Role/tenant/override matrix with results.

  3. 1:05–2:00 v1 vs v2 vs GraphQL same-object authz diff + H1 cases

    Test same object across v1/v2 + GraphQL (per-field, H1 #2633771 lesson) + THM graphql Task 3–4 preview (mutations/authz, batching) ONLY. Read hacktivity search IDOR order (Uber restaurant-analytics, api.pandao.ru order-address patterns) — version-gap note ONLY.

    H1: order IDOR searchTHM: graphql T3–4OWASP API: BFLA
    Why this matters ▼

    Pattern

    Legacy routes miss new checks. GraphQL needs per-field tests, not per-query.

    Done-when

    Version-diff table + 2 H1 version-gap notes.

  4. 2:00–2:35 BFLA checklist: role/tenant/method/version + SecLists params

    Build checklist + SecLists burp-parameter-names.txt 1 pass on 1 endpoint (lab). Columns: param × role × result.

    SecLists: param names
    Why this matters ▼

    Done-when

    Checklist + 1 param-discovery log.

  5. 2:35–3:00 Mass-assignment end-to-end test + gaps

    Narrate one full chain (field → endpoint → impact). Triage gaps.

    PATT: re-check
    Why this matters ▼

    Done-when

    Narrated + archived + gaps assigned.

Hunter mindset: Client-sent identity = suspect.
Real 180 min · proxy view vs backend view disagree = bypass

  1. 0:00–0:15 Normalization primitives cold

    List /..;/ // %2e %252e ; %00 + headers X-Original-URL, X-Rewrite-URL, X-Custom-IP-Authorization + verb swap. Check PATT 403 bypass header/method/encoding rows ONLY.

    PATT: 403 bypass rows
    Why this matters ▼

    What it is

    WAF/proxy normalizes differently than app — disagreement = access.

    Done-when

    Primitives + headers listed cold.

  2. 0:15–1:05 403 matrix on lab /admin (methods × headers × encodings)

    Build matrix: GET/POST/PUT/PATCH + headers + /..;/admin, double-slash, unicode. Read 405/404 vs 403 differential meaning (405 = verb wrong, 404 = path wrong, 403 = exists+blocked). YT: 403 bypass X-Original-URL live.

    PortSwigger: access matrixPATT: matrix rows
    Why this matters ▼

    Done-when

    Matrix with status/length per cell.

  3. 1:05–2:00 Next.js CVE-2025-29927 + admin-panel exposure cases

    Read NVD CVE-2025-29927 + GHSA-f82v-jwr5-mffw advisory § affected middleware + x-middleware-subrequest bypass ONLY + pentester.land 1 forced-browsing/admin-panel report — path found via robots/JS ONLY. Map to your matrix (which primitive class it belongs to).

    NVD: CVE-2025-29927GHSA: Next.js bypasspentester.land: forced browse
    Why this matters ▼

    Pattern

    Middleware trusts a header the attacker controls — same class as X-Original-URL. Version log → advisory match is the skill.

    YT

    Search CVE-2025-29927 nextjs bypass poc.

    Done-when

    Bypass class + affected-version check noted.

  4. 2:00–2:35 Bypass matrix final: header/method/encoding/differential

    Consolidate matrix. Add AuthMatrix preview (portswigger/authmatrix README roles matrix ONLY) for Week-07 reuse.

    AuthMatrix: matrix setupWSTG: ATHZ-02
    Why this matters ▼

    Done-when

    One-page matrix saved.

  5. 2:35–3:00 3 primitives + differential test + gaps

    Recite 3 + read a 403/404/405 triple cold. Triage gaps.

    PortSwigger: re-check
    Why this matters ▼

    Done-when

    Recited + matrix archived.

Hunter mindset: Disagreement between layers = access.
Real 180 min · solid finding first, chains later

  1. 0:00–0:15 Depth math + wrappers list

    State ../../../../etc/passwd depth counting + php://filter purpose. Check PortSwigger path-traversal topic intro + WSTG ATHZ-01 objectives ONLY.

    PortSwigger: traversal introWSTG: ATHZ-01
    Why this matters ▼

    What it is

    File param = traversal first. Depth + filter-bypass + wrapper columns.

    Done-when

    Math + wrapper list cold.

  2. 0:15–1:05 THM File Inclusion room: depth + filter + wrappers

    Do THM filepathtraversal Task 3–6 (LFI/RFI/payloads/challenges) ONLY + PortSwigger traversal labs 1–2 (absolute + stripped ../) ONLY. Test ....//, %2e%2e/, php://filter/convert.base64-encode/resource=index (source disclosure, lab).

    THM: filepathtraversal T3–6PortSwigger: labs 1–2HackTricks: LFI wrappers
    Why this matters ▼

    Done-when

    Depth walk + 2 bypasses + wrapper read logged.

  3. 1:05–2:00 Traversal file-read + LFI→RCE pivot theory (which pivot fired)

    Read pentester.land 1 traversal file-read (depth + bypass used) + HackTricks LFI § log-poisoning THEORY ONLY (no prod log writes). Note pivot: log vs wrapper vs upload (Week 09 executes).

    pentester.land: traversalHackTricks: LFI pivots
    Why this matters ▼

    Common mistake

    Writing to prod logs. CUT — lab theory only.

    Done-when

    Pivot map (3 options) noted.

  4. 2:00–2:35 Traversal matrix: depth/encoding/wrapper/parser

    Consolidate matrix + PATT File Inclusion rows + SecLists traversal wordlist path ONLY.

    PATT: file inclusion
    Why this matters ▼

    Done-when

    Matrix saved for Week 09.

  5. 2:35–3:00 Filter-bypass cold + gaps

    Explain your best bypass end-to-end. Triage gaps.

    PortSwigger: re-check
    Why this matters ▼

    Done-when

    Recited + matrix archived.

Hunter mindset: File param first, chain second.
Real 180 min · per-resolver authz, per-field tests

  1. 0:00–0:15 OWASP API Top 10 BOLA/BFLA/excessive-data defs

    Read OWASP API Top 10 API1/BOLA + API2/BFLA + excessive-data summaries ONLY. One sentence each + severity intuition.

    OWASP API: BOLA/BFLA/data
    Why this matters ▼

    Done-when

    3 defs + 1 severity line each.

  2. 0:15–1:05 THM GraphQL + PortSwigger GraphQL: introspection → field tests

    Do THM graphql Task 3–4 (mutations/authz, batching/IDOR) ONLY + PortSwigger GraphQL lab 1 (introspection → admin leak) ONLY. Query __schema, test isAdmin-class field A→B.

    THM: graphql T3–4PortSwigger: GraphQL lab 1inql schema tool
    Why this matters ▼

    YT

    Search GraphQL IDOR gid exploit + GraphQL introspection admin bug bounty.

    Done-when

    Schema map + 1 field-authz diff.

  3. 1:05–2:00 api.pandao.ru order-IDOR + excessive-data case

    Read hacktivity IDOR order (api.pandao.ru delivery-address pattern) + 1 excessive-data (list/detail leaks beyond UI need) — replay + minimization check ONLY.

    H1: order IDORH1: IDOR payloads
    Why this matters ▼

    Pattern

    Predictable order/invoice ID + token reuse. Excessive-data = verbatim over-collection evidence.

    Done-when

    2 patterns with minimization note.

  4. 2:00–2:35 API authz list: predictable IDs, array smuggling, version gaps

    Build list + test array index smuggling (id[]=1&id[]=2) on lab. Note v1/v2 delta for Week 10.

    WSTG: API testing
    Why this matters ▼

    Done-when

    List saved with 3 techniques.

  5. 2:35–3:00 Excessive-data vs BOLA + severity draft + gaps

    Distinguish + draft CVSS vector (first.org calculator base metrics ONLY). Triage gaps.

    CVSS 3.1 calculator
    Why this matters ▼

    Done-when

    Distinction + 1 vector + gaps assigned.

Hunter mindset: Per-field, per-version, per-role.
Real 180 min · chain turns low into critical

  1. 0:00–0:15 CVSS 3.1 metrics that move access-control scores

    Set vectors for IDOR-read vs IDOR-write vs BFLA-admin via first.org calculator + 2 FIRST examples ONLY. Note what raises (PII/admin/delete) vs lowers (self-only).

    CVSS: base metrics
    Why this matters ▼

    Done-when

    3 vectors with deltas explained.

  2. 0:15–1:05 Chain IDOR→PII→priv-esc on lab, trim to minimal PoC

    Build 1 chain on lab (IDOR read → emails → reset/role). Trim to fewest requests. Follow HuntBook chaining + PoC standards headings ONLY. YT: bug bounty chaining low to critical methodology.

    HuntBook: chainingPortSwigger: access chains
    Why this matters ▼

    Done-when

    Chain + minimal PoC + severity delta.

  3. 1:05–2:00 XSS→ATO + SSRF→metadata chain patterns (not payloads)

    Read pentester.land 1 XSS→ATO (handoff: cookie/session) + HackTricks SSRF § cloud pivot (role creds → s3 ls) — handoff steps ONLY. Note confirmation loop: isolate → baseline → reproduce ×2 → impact.

    pentester.land: chainsHackTricks: SSRF pivotTHM: ssrfhr preview
    Why this matters ▼

    Done-when

    2 handoff diagrams + loop card.

  4. 2:00–2:35 Severity worksheet + duplicate check

    Score your chain. Duplicate-check: pentester.land + H1 search same-program before drafting. Keep kill log.

    H1: dup checkbugpedia dup check
    Why this matters ▼

    Done-when

    Worksheet + dup result + kill/keep call.

  5. 2:35–3:00 Severity factors test + gaps

    Recite what moves IDOR/BFLA up/down. Triage gaps.

    CVSS: re-check
    Why this matters ▼

    Done-when

    Recited + worksheet archived.

Hunter mindset: Impact, not class.
Real 180 min · no control = no finding

  1. 0:00–0:15 Matrices recall: IDOR/BFLA/403/traversal

    Recite 4 matrices cold. Check WSTG checklist Authorization rows ONLY.

    WSTG: authz rows
    Why this matters ▼

    Done-when

    Recited + tick %.

  2. 0:15–1:05 Full authz map on VDP + Autorize on history

    Map all object endpoints (table from Day 1). Autorize ON, Enforcement Detector, compare A vs B. Log only, no state-changing deletes on live. THM burpsuitebasics Target/sitemap revisit.

    Autorize: enforce ONPortSwigger: replay guide
    Why this matters ▼

    X

    Search 403 bypass payload only if 403 blocks a replay — else stay on IDOR.

    Done-when

    Coverage map + Autorize log.

  3. 1:05–2:00 Same-program disclosed reports (pattern match)

    Read H1 hacktivity same-program family (IDOR/order) 2 reports — scope + key-type match ONLY. Compare your map gaps.

    H1: same-programH1: disclosed mirror
    Why this matters ▼

    Done-when

    2 pattern matches + gap paragraph.

  4. 2:00–2:35 Coverage + triage + kill log (validate ×2)

    Triage candidates: reproduce twice, else kill with reason. No PII exfil beyond minimal proof. Archive transcripts (redacted).

    HuntBook: triage gate
    Why this matters ▼

    Done-when

    Candidates triaged + kill log + transcripts.

  5. 2:35–3:00 Kill criteria + checklist + gaps to Week 04

    Recite kill rules (self-only, no-impact, dup). Update checklist. Assign gaps (JWT/OAuth/session) to Week 04.

    HuntBook: kill rules
    Why this matters ▼

    Done-when

    Recited + checklist + assignments.

Hunter mindset: Reproduce twice or kill.