I85PREP
⌘ K
HTB CWPE study materials
HTB CWPE study resources

HTB CWPE: Access Control Flaws (IDOR, Privilege Escalation, Business Logic)

HTB CWPE · Work through your exam, one topic at a time.

All guide sections

Access Control Flaws (IDOR, Privilege Escalation, Business Logic)

What this domain tests

Access Control Flaws tests IDOR, privilege escalation, and business-logic abuse. The exam focuses on whether the server enforces authorization on every object and action, not whether the UI hides a button.

Core rules and concepts

  • Build a role/object matrix: anonymous, user A, user B, support, admin. Test each role against each endpoint and object ID.
  • IDOR appears in path IDs, query parameters, JSON bodies, GraphQL node IDs, and headers such as X-User-Id.
  • Vertical escalation changes role or function; horizontal escalation changes the object owner. Test both.
  • Mass assignment often accepts role, isAdmin, verified, balance, or owner_id fields that the UI never sends.
  • Business logic flaws include negative quantities, currency rounding, coupon stacking, race conditions, and approval bypass.
  • Check indirect object references in exports, invoices, tickets, and file downloads.

Worked example

As user A (id=1002), GET /api/invoices/1002 returns your invoice. You request /api/invoices/1001 and receive another user's invoice with a different name and amount. The reasoning is that the endpoint authenticates the session but never checks invoice.owner_id == session.user_id. You confirm with a second low-privilege account, then test PATCH /api/users/1002 with {'role':'admin'} to see whether role assignment is mass-assignable.

Traps that cost marks

  • Testing only the UI; hidden endpoints and methods still enforce or fail authorization.
  • Assuming UUIDs are authorization; they are identifiers, not access control.
  • Using an admin account to reproduce a user-level bug.
  • Missing state-changing GET requests and multi-step approval flows.