thinQtankLABS

Web App Broken Access Control: Find, Confirm & Fix (Basic)

Hands-on with Broken Access Control (IDOR) (CWE-639) in Acme Billing's invoice viewer (/invoice?id=). Safely reproduce it with an inert training tool (no working exploit), classify it, score it with CVSS, then apply the correct fix and verify.

Beginner 20 guided steps 5 tasks About 55 minutes Runs in your browser

Skills you will practice

  • Secure web application concepts; Broken Access Control (IDOR) identification and prioritization; Web application testing; Object-level authorization
  • deny by default

Certifications this lab maps to

This lab builds hands-on skills that appear on these certification exams. thinQtank Learning runs instructor-led training camps for each — click one to see upcoming classes.

CompTIA Security+ SY0-701 Secure web application concepts Training at thinQtank Learning CompTIA CySA+ CS0-003 Vulnerability identification and prioritization Training at thinQtank Learning CompTIA PenTest+ PT0-003 Web application testing Training at thinQtank Learning
Part of these certification lab packages: Security+ SY0-701 CySA+ CS0-003 PenTest+ PT0-003 Certified in Cybersecurity (CC) GSEC GSEC GPEN GPEN

The scenario

A penetration test flagged Acme Billing's invoice viewer (/invoice?id=) as Broken Access Control (IDOR) (CWE-639). You are the app-security engineer. Start by understanding it.

What you will do

  1. Understand the feature and the finding4 steps

    Open the engagement · Read the finding · Which weakness class? · Read the feature config

  2. Reproduce it safely5 steps

    Fetch your own invoice · Fetch another user's invoice · Capture the cross-user access · Review the evidence · …

  3. Assess the severity4 steps

    Find the CVSS vector · Compute the base score · What is the base score? · Why this severity?

  4. Fix it4 steps

    Which fix is right? · Baseline scan · Apply the fix · Confirm the config

  5. Verify3 steps

    Verify with a scan · If it was already exploited? · Document the work

How this lab works

A real Linux-style console. Commands run against real files, so hashes, hex dumps and comparisons give real results.

A file browser where you can place evidence into the lab, either the file provided or one of your own.

Reset a single step, a whole task or the entire lab. The environment is rebuilt so you can try again cleanly.

Progress saves after every step. Close the tab and come back later; your files and answers are waiting.