Move Byline Authorization with airSlate SignNow

Merge byline authentication

Let’s talk about a vulnerability class that, maybe, requires less technical knowledge than most other attacks. So it can be a great area for people who just started doing bug bounties. But a good understanding of an app’s functionality is required. I’m liveoverflow and I run a YouTube channel about hacking competitions, bug bounty and anything security related. So Google asked me to talk with you about Authorization bugs and lateral escalation vulnerabilities. These terms Authentication, Authorization and lateral escalation may sound very technical and crazy, but let me explain. Let’s start by talking about the difference between Authentication and Authorization. Authentication describes functionality that identifies a user. For example your username and password can authenticate, so identify you, so Google can give you access to your Google Mail. Authorization on the other hand is about what a user is allowed to do. For example in google drive, authorization checks decide if you are allowed to access a certain document, or if you are only allowed to leave comments or even edit the document. Those are questions of authorization. So authorization is usually more important in bigger web applications. Simple web apps oftentimes have no difference in user roles, or maybe only two. So oftentimes you could have admin users, which can access restricted admin APIs, and you have regular users that should not be able to access the admin API. So an example authorization bug is it, when it turns out a regular user CAN access an admin API endpoint. In contrast, an authentication bug could be, if you manage to login as an admin, by exploiting a SQL injection in the login field for example. So authorization bugs are about the permissions certain users have, and in big complex applications, especially those used by a big company, you might have very complicated permission systems. And that’s why we talk about it now. Let’s have a quick look at Google Cloud how a complex authorization system can look like. On Google Cloud you can run tons of different services like databases, kubernetes, storage systems, whatever you want. And here in the Identity and Access Management you can see the different user and service accounts including their roles and permissions. And in very big companies with multiple engineering teams you might want to carefully control what kind of access each employee has. You see, it can get complex fast. So let’s talk about the challenges with permissions and roles and how this relates to bug hunting. Let’s imagine a web app with a functionality to impersonate other users. But this can only be done if you have the “impersonate user” permission. This is intended for developers or support staff to debug very weird account issues. But giving direct access to an account is a huge invasive act, so this permission is only given to team leads. Regular support staff or regular developers cannot do that. BUT each support staff has the permissions to change the email of an account. Because...