Access across roles
One role performs actions reserved for another.
home / services
service · access and logic
IDOR and access control testing: roles, users and business logic
Who can see and change what, and which business rules can be bypassed. This is the service scanners do not cover.
what it covers
What we check.
Access across users
A user reads or changes another user's data by changing an identifier.
Multi-step flows
A step can be skipped or repeated with wrong results.
Prices, quantities and discounts
Values the client should not be able to choose.
Order states
Transitions between order states that the process does not allow.
Administrative functions
Management functions reachable from unauthorised roles.
how we work
A fixed method, with a person at the end.
Role matrix
The client provides the roles and the actions each one should be able to perform.
Hypotheses per pair of roles
The plan proposes cross-checks, one by one.
Controlled test
Each request is logged with the role that sent it.
Review
A person reproduces each vulnerability and assigns the severity.
Report
Role, action, expected result, actual result and fix.
included and not included
What you receive, and what is not in the service.
Included
- Matrix of the roles tested
- Report with reproducible requests
- Severity assigned by a person
- Fix for every confirmed vulnerability
Not included
- Testing without a signed authorisation
- Denial-of-service testing
- Social engineering or physical attacks
- Testing of third-party systems
- Tests on real accounts of the client's own customers
service sheet
To get started.
| Item | Detail |
|---|---|
| Type of test | Gray box with at least two roles per flow |
| To start, we need | Role matrix, two accounts per role, test environment |
| Delivery | Report with the role matrix and log |
| Price | from €4,500 to €7,500 |
Want to check who can do what in your application?
We reply by hand with a written proposal.