Webgoat Series のaccess Control Flaws (access control defect)

Using an Access Control Matrix

User rights:

Moe--> Public Share

Larry--> Time Card entry,performance review,time card Approval,account Manager

curly--> public share,performance review,time Card Approval

Shemp->site Manager,account Manager

Bypass a Path Based Access Control Scheme

Access file paths with Burp capture package modification

After forward

Lab:role Based Access Control

Stage 1:bypass Business Layer Access Control

This is really the kind of question that will appear in the CTF.

Stage 2:add Business Layer Access Control

Stage 3:bypass Data Layer Access Control

The same reason, after blocking the package to change the user's ID to see other people's data

Stage 4:add Data Layer Access Control

Remote Admin Access

Webgoat Series のaccess Control Flaws (access control defect)