This is a simple Golang web application that contains an example of a Broken Access Control vulnerability.
Definition from OWASP:
Restrictions on what authenticated users are allowed to do are often not properly enforced. Attackers can exploit these flaws to access unauthorized functionality and/or data, such as access other users' accounts, view sensitive files, modify other users’ data, change access rights, etc.
To build this lab you will need Docker and Docker Compose.
After cloning this repository, you can type the following command to start the vulnerable application:
$ make installThen simply visit localhost:8888 !
To understand how this vulnerability can be exploited, check this section!
(Spoiler alert 🧐) To understand how this vulnerability can be mitigated, check this other section!
Yes, please. ⚡