Role Profiles and Access Matrix

Role Profiles and Access Matrix

Testing access control by hand means logging in as each role and sending the same request again and again. The access matrix does it in one go.

1. Save a profile for each role you have a test account for.
2. Replay one request as every role at once.
3. Read the matrix to see who can access what.

Before you start

You need a test account for each role, for example admin, user and guest. Use accounts the program gives you, or ones you created on a system you own. Never use someone else's account.

1. Save a profile for each role

1. Open Repeater from the toolbar.
2. Click Profiles….
3. Add a profile for each role, with that role's cookies or headers.
4. Click Save profile for each one.

2. Run the matrix

1. Load a request in Repeater.
2. Click Access matrix….
3. Choose the profiles to compare.
4. Click Run matrix.

3. Read the matrix

The matrix shows each role's response to the same request.

What to look for: a low-privilege role getting the same data as a high-privilege one. That points to IDOR or broken access control.

Before you report it, check that the response really contains the other role's data, not just a generic page or an error that looks the same.

Let the AI use your profiles

The AI can use your saved profiles too. Just ask it to check access control with your roles.

Related

• HTTP Repeater
• Collaborator
• Findings & Reports
• Bug-Bounty Hunting