Authorization determines what an authenticated user is allowed to do within an application. Unlike authentication (verifying who you are), authorization controls what you can access. This category tests for broken access controls including directory traversal, privilege escalation, insecure direct object references, and authorization bypass. Authorization vulnerabilities are the number one risk in the OWASP Top 10 (A01:2021) because they are widespread, often application-specific, and difficult to detect with automated tools. They require understanding the application's business logic and testing with multiple user roles. For penetration testers and bug bounty hunters, authorization testing is one of the most rewarding areas because these findings often have high severity and direct business impact.
OWASP Top 10 Mapping
This testing category relates to the following OWASP Top 10 2021 categories:
Quick Reference
| Test ID | Name | CWEs | Difficulty |
|---|---|---|---|
| WSTG-ATHZ-01 | Directory Traversal | CWE-22, CWE-98 | Intermediate |
| WSTG-ATHZ-02 | Authorization Schema Bypass | CWE-862, CWE-863 | Intermediate |
| WSTG-ATHZ-03 | Privilege Escalation | CWE-269, CWE-862 | Intermediate |
| WSTG-ATHZ-04 | IDOR Testing | CWE-639 | Intermediate |
| WSTG-ATHZ-05 | OAuth Testing | CWE-601, CWE-862 | Intermediate |
Detailed Test Cases
WSTG-ATHZ-01: Directory Traversal
IntermediateDirectory traversal (path traversal) testing attempts to access files outside the intended directory by manipulating file path parameters with sequences like ../ or URL-encoded equivalents. Successful exploitation can read sensitive system files, configuration files, or application source code.
What to Check
- Test parameters that reference files with ../ sequences to escape the intended directory
- Try URL-encoded and double-encoded traversal sequences (%2e%2e%2f, %252e%252e%252f)
- Attempt to read known system files (/etc/passwd on Linux, C:\boot.ini on Windows)
- Test for null byte injection to bypass file extension restrictions
- Check for Local File Inclusion (LFI) and Remote File Inclusion (RFI) in include parameters
WSTG-ATHZ-02: Authorization Schema Bypass
IntermediateThis test attempts to bypass the application's authorization controls to access pages, functions, or data that should be restricted. It tests whether authorization is enforced consistently on both the client and server side.
What to Check
- Access administrative URLs directly while logged in as a regular user
- Replay requests captured from a privileged session using a lower-privilege session token
- Test whether authorization checks apply to both GET and POST requests for the same resource
- Modify request parameters that indicate user role or permission level
- Check if removing authorization headers or cookies allows access to restricted endpoints
WSTG-ATHZ-03: Privilege Escalation
IntermediatePrivilege escalation testing checks whether a user can elevate their access level within the application. Vertical escalation gains higher-privilege access (user to admin), while horizontal escalation accesses another user's data at the same level.
What to Check
- Test vertical escalation by accessing admin functions with a regular user session
- Test horizontal escalation by changing user identifiers in requests to access other users' data
- Modify role or group parameters in POST requests during account updates
- Check if API endpoints enforce the same authorization as the web interface
- Test whether modifying JWT claims or session attributes can elevate privileges
WSTG-ATHZ-04: IDOR Testing
IntermediateIDOR testing checks whether changing a reference to an object (like an ID, filename, or key in a URL or request body) allows access to another user's data without authorization checks. This is one of the most commonly found and easily exploited web vulnerabilities.
What to Check
- Modify numeric IDs in URLs and request parameters to access other users' records
- Test file download endpoints by changing filenames or document IDs
- Check API responses for references to objects belonging to other users
- Test sequential and predictable identifiers versus random UUIDs
- Verify authorization on all CRUD operations (Create, Read, Update, Delete) for each object
WSTG-ATHZ-05: OAuth Testing
IntermediateThis test evaluates OAuth implementations for common security weaknesses including open redirectors in the redirect_uri, authorization code reuse, missing state parameter validation, and insecure token storage. OAuth complexity creates many opportunities for implementation errors.
What to Check
- Test for open redirect vulnerabilities in the redirect_uri parameter
- Verify the state parameter is used and validated to prevent CSRF attacks
- Check if authorization codes can be reused or are properly single-use
- Test whether access tokens are transmitted and stored securely
- Verify that scope escalation is not possible through parameter manipulation
Relevant Certifications
The following certifications cover authorization testing concepts:
Frequently Asked Questions
What is the difference between authentication and authorization in web security?
Authentication verifies a user's identity (who are you?), while authorization determines what that user is allowed to do (what can you access?). A user can be properly authenticated but still access resources they should not be authorized to view. Authorization vulnerabilities are ranked as the number one web application security risk by OWASP.
What are Insecure Direct Object References (IDOR) and why are they so common?
IDOR vulnerabilities occur when an application uses user-supplied input to directly access objects (like database records or files) without verifying that the user is authorized to access that specific object. They are common because developers often implement authentication but forget to add object-level authorization checks, assuming that if a user is logged in, they should have access to any resource they can reference.
How do you test for privilege escalation in web applications?
Privilege escalation testing involves attempting to access higher-privilege functionality while logged in as a lower-privilege user. Horizontal escalation means accessing another user's data at the same privilege level, while vertical escalation means gaining admin-level access from a regular user account. Testers use techniques like changing user IDs in requests, modifying role parameters, and accessing admin endpoints with regular user tokens.
CyberFolio
Mastering web security testing? Showcase your skills.
Build a free, shareable cybersecurity portfolio that highlights your certifications, projects, and skills.
Build Your Portfolio →