Broken Access Control labs
Broken Access Control (BAC)
What is Broken Access Control?
Broken Access Control is #1 in the OWASP Top 10. It covers any situation where a user reaches resources or functionality they're not authorized for: vertical (privilege escalation) and horizontal (accessing another same-level user's data).
Why practice Broken Access Control?
BAC is the #1 category in the OWASP Top 10 2021 — more than 90% of tested applications have it. In bug bounty it accounts for a huge share of triaged reports. Bounties for privilege escalation to admin typically exceed $3,000.
What will you learn with the Broken Access Control labs?
You'll learn to map roles and endpoints, detect missing checks in Express middleware, abuse feature flags exposed in /me, and document a PoC with two accounts (low-priv + high-priv) that proves a real bypass.
Types of Broken Access Control we cover
- Vertical privilege escalation
A normal user reaches admin functions. The admin endpoint doesn't check the role or checks it via a manipulable header/cookie.
- Horizontal escalation
User A reaches user B's resources (same role). Essentially IDOR.
- Forced browsing
Unlinked but directly reachable admin URLs. /admin, /admin/api, /internal.
- Client-side authz bypass
The frontend hides buttons by role but the backend doesn't reject the request. A direct call = bypass.
How do you find and exploit Broken Access Control?
A practical playbook — from recon to proof of concept.
- 1
Map roles and routes
Log in as admin (or read the frontend JS) and note every privileged endpoint. Then replay them with a normal account.
From the JS bundle: /api/admin/users, /api/admin/reports, /internal/flags - 2
Call the admin endpoint as low-priv
Replay the admin request with the non-privileged account's cookie/token. If it responds 200, the role check is missing on the backend.
GET /api/admin/users (with a basic user's token) → 200 = BAC - 3
Forced browsing
Try unlinked admin routes and their API variants. Many apps protect the view but not the endpoint that feeds it.
/admin · /admin/api/users · /api/v1/internal/config - 4
Bypass via override headers
Some middleware trusts routing/proxy headers. Try them to skip the access rule.
X-Original-URL: /admin · X-Forwarded-For: 127.0.0.1 · X-Rewrite-URL: /admin - 5
Abuse client-side flags
If /me exposes isAdmin/role or the front hides buttons by role, call the protected action directly, ignoring the UI.
POST /api/users/3/promote {"role":"admin"} (the UI hid it, the backend allows it)
Learn the theory
Academy: IDOR & Broken Access Control
Loading labs...
View in full catalog →Frequently asked questions
What is Broken Access Control?
It's the #1 OWASP Top 10 category: any situation where a user reaches resources or functions they're not authorized for, whether escalating privileges (vertical) or accessing other same-level users' data (horizontal).
How is Broken Access Control exploited?
You replay requests to privileged functions or resources with a lower-privilege account or no session. If the backend doesn't re-check the role/ownership and returns the data or runs the action, access control is broken.
How do you find BAC in bug bounty?
Enumerate endpoints from the JS and the API docs, test each one with different-role accounts, force hidden admin routes, and experiment with override headers (X-Original-URL) and alternate HTTP methods.
How do you prevent Broken Access Control?
Apply default-deny authorization on the server, centralize checks in middleware, validate role and ownership on every request, never trust frontend controls, and log access failures for detection.
Difference between BAC, IDOR and privilege escalation?
BAC is the general concept. IDOR is its horizontal variant (accessing other users' objects). Privilege escalation is its vertical variant (a normal user reaching admin functions).
Other related categories
- hunters training
- 650
- labs from real reports
- 50
- completions
- 380
- in bounties practiced
- $200,000
hunters training
labs from real reports
completions
in bounties practiced
Practice Broken Access Control in real labs
Every Broken Access Control lab replicates a real bug bounty report that got paid. Create your free account, start with the Academy and move to the labs whenever you want.
No card · free Academy · cancel anytime