Access Control Testing Project

A Flask-based security testing project designed to demonstrate and identify access control vulnerabilities in web applications.

Table of Contents

• Overview
• Security Testing Purposes
• Project Structure
• Vulnerability Demonstration
• Installation & Setup
• Running Tests
• Test Results
• Security Findings
• Remediation Guidelines
• Educational Value
• Contributing
• License

Overview

This project contains a deliberately vulnerable Flask web application with comprehensive security tests. It serves as an educational tool for understanding access control vulnerabilities and demonstrates how proper security testing can identify critical security flaws.

⚠️ WARNING: This application contains intentional security vulnerabilities for educational purposes only. Do not deploy to production environments.

Security Testing Purposes

🎯 Primary Objectives

1. Demonstrate Broken Access Control (CWE-284)

   • Show how insufficient authorization checks can lead to privilege escalation
   • Illustrate the difference between authentication and authorization
   • Provide real-world examples of access control failures

2. Security Test Development

   • Build comprehensive test suites for authentication mechanisms
   • Implement automated security vulnerability detection
   • Create repeatable security testing workflows

3. Educational Security Training

   • Teach developers about common access control mistakes
   • Demonstrate proper security testing methodologies
   • Show how to identify and fix authorization vulnerabilities

🔍 Testing Scenarios Covered

• Authentication Testing

  • Valid credential verification
  • Invalid credential rejection
  • Session management validation

• Authorization Testing

  • Role-based access control verification
  • Privilege escalation detection
  • Unauthorized access attempts

• Session Security Testing

  • Session persistence validation
  • Logout functionality verification
  • Session state management

Project Structure

access_control_testing/
├── app.py                 # Flask application with vulnerability
├── app_test.py           # Comprehensive security test suite
├── test_report.md        # Detailed security analysis report
├── README.md             # Project documentation (this file)
├── LICENSE               # Project license
└── __pycache__/          # Python bytecode cache
    ├── app.cpython-312.pyc
    └── app.cpython-313.pyc

File Descriptions

File	Purpose	Key Features
app.py	Main Flask application	Authentication, session management, vulnerable admin endpoint
app_test.py	Security test suite	7 comprehensive test cases, proper shutdown mechanism
test_report.md	Security analysis	Vulnerability documentation, remediation steps
README.md	Project documentation	Setup instructions, security context

Vulnerability Demonstration

🚨 Intentional Security Flaw

The application contains a Critical Access Control Vulnerability in the /admin endpoint:

@app.route('/admin')
def admin_panel():
    # Vulnerable access control: no role check
    if 'username' in session:
        return 'Admin Panel - only for admins'
    return redirect(url_for('index'))

Problem: The code only checks if a user is authenticated ('username' in session) but fails to verify if the user has administrative privileges (session.get('role') == 'admin').

Impact: Any authenticated user can access administrative functionality, leading to privilege escalation.

Installation & Setup

Prerequisites

• Python 3.7+
• pip package manager

Installation Steps

1. Clone the repository:

   git clone <repository-url>
   cd access_control_testing

2. Install dependencies:

   pip install flask requests

3. Verify installation:

   python app.py

Running Tests

Execute Security Tests

# Run the complete test suite
python app_test.py

# Expected output: 6/7 tests pass, 1 security vulnerability detected

Test Features

• Automated Server Management: Tests start/stop Flask server automatically
• Session Persistence: Proper cookie handling for authentication testing
• Graceful Shutdown: No hanging processes after test completion
• Comprehensive Coverage: Authentication, authorization, and session management

Test Results

Current Test Status

Test Case	Status	Security Implication
test_login_admin	✅ PASS	Authentication works correctly
test_login_user	✅ PASS	User authentication functions
test_login_invalid_credentials	✅ PASS	Brute force protection active
test_access_admin_panel_as_admin	✅ PASS	Admin access works as intended
test_access_admin_panel_as_user	❌ FAIL	🚨 SECURITY VULNERABILITY
test_access_admin_panel_as_unauthenticated	✅ PASS	Unauthenticated access blocked
test_logout	✅ PASS	Session clearing works properly

Overall Result: 6/7 tests passed (85.7% pass rate)

Security Findings

🚨 Critical Vulnerability: Broken Access Control

• CVE Classification: CWE-284 (Improper Access Control)
• Severity: HIGH (CVSS 8.5)
• OWASP Category: A01:2021 – Broken Access Control

Vulnerability Details

Root Cause: Missing role-based authorization check in admin endpoint

Proof of Concept:

1. Regular user logs in with valid credentials
2. User accesses /admin endpoint
3. Application grants access based solely on authentication status
4. User gains unauthorized access to administrative functions

Business Impact

• Confidentiality: Unauthorized access to sensitive admin data
• Integrity: Potential modification of system settings
• Availability: Risk of system disruption through admin functions
• Compliance: Violation of principle of least privilege

Remediation Guidelines

🔧 Immediate Fix Required

Replace the vulnerable admin endpoint with proper role checking:

@app.route('/admin')
def admin_panel():
    if 'username' not in session:
        return redirect(url_for('index'))
    
    # Add proper role-based access control
    if session.get('role') != 'admin':
        return 'Access Denied: Admin privileges required', 403
        
    return 'Admin Panel - only for admins'

📋 Security Best Practices

1. Implement Role-Based Access Control (RBAC)

   • Always verify both authentication AND authorization
   • Use decorator functions for consistent access control
   • Implement principle of least privilege

2. Secure Session Management

   • Use secure session configuration
   • Implement session timeout mechanisms
   • Validate session integrity on each request

3. Input Validation & Error Handling

   • Sanitize all user inputs
   • Return appropriate HTTP status codes
   • Avoid information leakage in error messages

🛡️ Security Testing Integration

# Example: Decorator for role-based protection
def require_role(required_role):
    def decorator(f):
        @wraps(f)
        def decorated_function(*args, **kwargs):
            if 'username' not in session:
                return redirect(url_for('login'))
            if session.get('role') != required_role:
                return 'Access Denied', 403
            return f(*args, **kwargs)
        return decorated_function
    return decorator

# Usage
@app.route('/admin')
@require_role('admin')
def admin_panel():
    return 'Admin Panel - only for admins'

Educational Value

🎓 Learning Objectives

This project helps developers understand:

1. Common Security Vulnerabilities

   • How access control flaws occur in real applications
   • The difference between authentication and authorization
   • Impact of insufficient security controls

2. Security Testing Methodologies

   • Automated vulnerability detection techniques
   • Comprehensive test case development
   • Security-focused test design patterns

3. Secure Development Practices

   • Implementation of proper access controls
   • Security-by-design principles
   • Code review for security vulnerabilities

📚 Use Cases

• Security Training Programs: Hands-on vulnerability demonstration
• Code Review Training: Example of what to look for in security reviews
• Penetration Testing: Baseline vulnerable application for testing tools
• DevSecOps Integration: Template for security test automation

Contributing

Security Contributions Welcome

• Additional test cases for edge scenarios
• Integration with security scanning tools
• Documentation improvements
• Additional vulnerability examples

Development Guidelines

1. All security tests must pass (except intentional vulnerability detection)
2. New vulnerabilities should be clearly documented
3. Include remediation examples for any new security flaws
4. Update test report documentation

License

This project is licensed under the MIT License - see the LICENSE file for details.

---

⚠️ Security Notice

This application is intentionally vulnerable and designed for portfolio purposes only.

• DO NOT deploy this application in production environments
• DO NOT use this code as a template for real applications without implementing proper security controls
• ALWAYS implement proper access control mechanisms in production code
• REVIEW all security implementations with qualified security professionals