Access
Control
If a website hides its admin page but never checks who is accessing it, anyone can become an admin just by changing the URL. We’re going to do exactly that.
What You'll Learn
By the end of this workshop, you'll be able to spot and exploit missing access controls—one of the most common and dangerous web vulnerabilities.
Core Concepts
Access control determines what actions a user is allowed to perform. The vulnerability arises when the server trusts the client to enforce restrictions.
Why hiding links isn't security
Many developers assume that if they don't show an "Admin" link to regular users,
those users won't find the admin page. But attackers directly request
/admin or /manage. The only safe approach is server‑side
verification of the user's role on every request.
Common weak patterns
- Relying on JavaScript to hide UI elements
- Checking permissions only on the frontend
- Using predictable IDs or paths without authorization checks
?id=123 to ?id=124) and Vertical
(gaining higher privileges, e.g., accessing /admin as a regular user).Horizontal escalation (IDOR)
Insecure Direct Object Reference: you can view or edit another user's private data just by changing an ID in the URL or request body.
Vertical escalation
You perform actions reserved for a higher privilege role (admin, moderator). This often happens when the server doesn't check role before executing admin functions.
Changing the URL to
/admin grants access to restricted functionality because the server does not enforce
permission checks.
The 4‑Step Exploit
A typical broken access control workflow—from normal usage to full admin access.
- Observe available pages and features (no admin link visible)
- Note the URL structure and any ID parameters
- Try common paths:
/admin,/dashboard,/manage - Manually modify the URL in the browser's address bar
- Directly navigate to
https://target.com/admin - Bypass UI restrictions — the server may still respond
- Server does not verify permissions → restricted content returned
- Perform admin actions (delete users, view sensitive data)
# Step 1: access the lab as a normal user Open the lab URL in browser → Expected: normal homepage loads (no admin link) # Step 2: modify the URL to access admin page Change URL from: https://<lab-id>.web-security-academy.net/ to: https://<lab-id>.web-security-academy.net/admin → Expected: admin panel loads successfully # Step 3: interact with admin functionality Click "Delete" or any admin action → Expected: action succeeds without authentication check
Common Pitfalls
Test Your Knowledge
/admin while logged in as a normal user and see the admin
panel. What is the most likely explanation?Now Do It Yourself
/admin)./admin to the base lab URL.Further Resources
PortSwigger Web Security Academy
Interactive labs covering access control vulnerabilities (free). Start with "Unprotected admin functionality".
OWASP Top 10: Broken Access Control
High‑level overview of the most critical access control risks in modern applications.
OWASP Authorization Cheat Sheet
Practical guidelines for implementing secure access control correctly.
Access Control Cheat Sheet (PDF)
Handout with quick reference on broken access control patterns. (Available in workshop materials)