🔐 Access Control Hunting Handbook - 20 Techniques with Methodologies
1. Vertical Privilege Escalation
Method: Identify admin-only endpoints (/admin, /manage). Replay requests as a low-
privileged user. Modify role flags in requests (isAdmin=false → true).
2. Horizontal Privilege Escalation
Method: Look for userId/account/document IDs in parameters. Change them to another
valid ID. Verify if data from another user is accessible.
3. Business Logic Flaws
Method: Intercept client-side restricted actions (e.g., transfer >10,000). Modify
request body directly in Burp/Repeater to bypass UI restrictions.
4. Forced Browsing
Method: Use dirsearch/ffuf to discover hidden directories (/backup, /logs). Try
direct access to sensitive resources without auth.
5. Parameter-Based Access Control
Method: Identify hidden role/permission parameters. Change values (role=user →
role=admin). Attempt HTTP Parameter Pollution (role=admin&role=user).
6. Referer/Token Based Control
Method: Remove Referer/auth headers and replay. Forge headers like X-Forwarded-For
or X-Role. Attempt bypass with fake tokens.
7. Unprotected API Endpoints
Method: Inspect mobile apps/JS for API endpoints. Replay API requests without
authentication. Try fuzzing with curl/Postman.
8. CORS Misconfigurations
Method: Send Origin: [Link] header. If server reflects back Access-Control-Allow-
Origin: [Link], exfiltrate sensitive responses.
9. HTTP Method Bypass
Method: Attempt alternate verbs (HEAD, OPTIONS, PUT, PATCH). Example: GET /admin
may be blocked but POST /admin allowed.
10. Unvalidated File/Function Access
Method: Modify file parameters in download endpoints (/download?file=[Link] →
[Link]). Check for unrestricted file uploads.
11. Race Conditions (TOCTOU)
Method: Send concurrent requests with Turbo Intruder or curl &. Exploit
inconsistent access checks during state changes.
12. Re-authentication Bypass
Method: Identify critical re-auth flows (/verify-password). Replay sensitive
requests directly, skipping verification step.
13. Password Reset / Account Takeover
Method: Analyze reset token requests. Change user parameter (user=123 → user=124)
to reset another user’s password.
14. JWT Manipulation
Method: Decode JWT. Test alg=none. Try brute-forcing weak HMAC keys. Modify claims
(role:user → role:admin).
15. Cloud Storage ACL Misconfigurations
Method: Enumerate cloud storage (S3/GCP/Azure). Check if buckets/blobs are public.
Attempt direct object access.
16. SSRF + Access Control Chaining
Method: Exploit SSRF endpoints (/fetch?url=). Access internal admin-only services
([Link]
17. Cache Poisoning Bypass
Method: Poison shared caches with crafted requests. Cause app to serve admin-only
data to normal users.
18. Multi-Tenancy Weakness
Method: Inspect tenant IDs in API calls (/tenant/1234/user). Change ID to access
another tenant’s data.
19. GraphQL Role Manipulation
Method: Enable introspection. Identify hidden admin fields. Test mutations
(updateUser(id:2, role:"admin")).
20. Microservices Role Enforcement Gaps
Method: Map all microservices. Replay restricted requests against weaker services
that don’t enforce access control strictly.