- Lab
-
Libraries: If you want this lab, consider one of these libraries.
- Security
Broken Function Level Authorization
In this lab, you are an application security engineer auditing a Python user-management API. You will use a regular-user session to access administrative functions hidden by the interface, then verify that server-side authorization checks prevent unauthorized access. ### Scenario The portal hides administrative controls from regular users. However, the API allows any authenticated user to list accounts and trusts a client-supplied role header to authorize account deletion. You will exploit both vulnerabilities using a local Python API client. All requests remain within the sandbox. The application uses fictional users and in-memory data. You do not need external internet access or additional package downloads. ### What You'll Learn By the end of this lab, you will be able to: - Identify missing authorization checks and authorization checks that trust client-controlled data. - Modify HTTP paths, methods, and headers to invoke administrative functions as a regular user. - Confirm unauthorized access to account information and account deletion. - Verify that server-side role checks reject unauthorized requests.
Lab Info
Table of Contents
-
Challenge
Identify & Exploit BFLA Vulnerabilities
Broken Function Level Authorization (BFLA) occurs when an API fails to enforce permission checks for a function. An authenticated regular user can invoke an administrative function by sending a request directly, regardless of which controls the interface displays.
You will exploit an unprotected user-listing endpoint and a deletion endpoint that trusts a forged role header. You will then verify authorization checks based on the server-held identity.
-
Challenge
Remediate BFLA Vulnerabilities
Now that you've seen the BFLA Vulnerabilities at play, you turn your attention to neutralizing them.
Real skill practice before real-world application
Hands-on Labs are real environments created by industry experts to help you learn. These environments help you gain knowledge and experience, practice without compromising your system, test without risk, destroy without fear, and let you learn from your mistakes. Hands-on Labs: practice your skills before delivering in the real world.
Learn by doing
Engage hands-on with the tools and technologies you’re learning. You pick the skill, we provide the credentials and environment.
Follow your guide
All labs have detailed instructions and objectives, guiding you through the learning process and ensuring you understand every step.
Turn time into mastery
On average, you retain 75% more of your learning if you take time to practice. Hands-on labs set you up for success to make those skills stick.