Cybersecurity Academy - Access Control & File Upload Vulnerabilities
This workshop is delivered as part of both the Blue Team and Red Team specializations. While the two tracks share a common foundation, the topics, practical activities, and learning objectives are tailored to the students’ chosen specialization. The description below currently outlines the Red Team focus; details of the Blue Team focus will be added once finalized.
A hands-on web security module focused on identifying and exploiting access control and file upload vulnerabilities in deliberately vulnerable web applications. Students learn how weaknesses in authorization, privilege management, resource ownership, file validation, and server configuration can lead to unauthorized access, privilege escalation, data exposure, or remote code execution. The module covers vertical and horizontal privilege escalation, IDOR, parameter-based access control, multi-step workflows, method and URL-based bypasses, file type and content validation, filename handling, upload processing, and insecure server configurations.
A hands-on web security module focused on identifying and exploiting access control and file upload vulnerabilities in deliberately vulnerable web applications. Students learn how weaknesses in authorization, privilege management, resource ownership, file validation, and server configuration can lead to unauthorized access, privilege escalation, data exposure, or remote code execution. The module covers vertical and horizontal privilege escalation, IDOR, parameter-based access control, multi-step workflows, method and URL-based bypasses, file type and content validation, filename handling, upload processing, and insecure server configurations.
Learning Outcomes
By the end of the course, students will be able to:
- Explain authentication, session management, and access control and how they differ.
- Identify vertical, horizontal, and context-dependent access control vulnerabilities.
- Identify privilege escalation opportunities caused by flawed authorization controls.
- Test whether sensitive functionality is properly protected from unauthorized users.
- Analyze and manipulate user-controlled parameters, cookies, and request data that influence authorization decisions.
- Identify and assess insecure direct object references (IDOR) and unauthorized access to other users' resources.
- Test access controls across multi-step application workflows.
- Identify weaknesses involving HTTP methods, URL matching, and request headers.
- Assess file upload functionality for weaknesses in filename, extension, MIME type, content, and size validation.
- Identify insecure file storage and server-side file execution risks.
- Understand how flawed upload validation and server configuration can lead to code execution or other security impacts.
- Identify file upload vulnerabilities that can result in client-side attacks, source-code disclosure, or other unintended behavior.
- Use Burp Suite to intercept, modify, and analyze application requests and responses.
- Apply a structured methodology for testing authorization controls and file upload functionality.
- Understand secure access control, file validation, storage, naming, and server configuration practices.
Training Method
The module follows a hands-on testing and exploitation methodology using
deliberately vulnerable web application labs. Students analyze
authorization mechanisms, manipulate requests with Burp Suite, test
different user roles and resource identifiers, and investigate how
inconsistent access control enforcement can be bypassed. For file
uploads, students examine validation mechanisms, request parameters,
file metadata, content handling, storage locations, and server behavior
to identify security weaknesses. The emphasis is on understanding why
the vulnerability occurs and how application components interact, rather
than simply reproducing solutions. Students progressively test,
troubleshoot, and reproduce vulnerabilities in realistic scenarios
before moving to more complex challenges.