Read more about this topic in OWASP’s Development and Testing Guides 4 5 6 7 Authorization Authorization Authorization Authorization Kelly can bypass authorization Chad can access resources Eduardo can access data he does Yuanjing can access application controls because they do not fail (including services, processes, not have permission to, even functions, objects, or properties securely (i.e. they default to AJAX, Flash, video, images, though he has permission to the he is not authorized to access allowing access) documents, temporary files, form/page/URL/entry point session data, system properties, configuration data, registry settings, logs) he should not be able to due to missing authorization, or due to excessive privileges (e.g. not using the principle of least privilege) 8 9 10 J Authorization Authorization Authorization Authorization Tom can bypass business rules by Mike can misuse an application Richard can bypass the Dinis can access security altering the usual process by using a valid feature too fast, centralized authorization controls configuration information, or sequence or flow, or by or too frequently, or other way since they are not being used access control lists undertaking the process in the that is not intended, or consumes comprehensively on all incorrect order, or by the application's resources, or interactions manipulating date and time causes race conditions, or values used by the application, or a feature by using valid features for unintended purposes, or by otherwise manipulating control data
Read more about this topic in OWASP’s Development and Testing Guides Authorization 4 Authorization 5 Authorization 6 Authorization 7 Kelly can bypass authorization controls because they do not fail securely (i.e. they default to allowing access) Chad can access resources (including services, processes, AJAX, Flash, video, images, documents, temporary files, session data, system properties, configuration data, registry settings, logs) he should not be able to due to missing authorization, or due to excessive privileges (e.g. not using the principle of least privilege) Eduardo can access data he does not have permission to, even though he has permission to the form/page/URL/entry point Yuanjing can access application functions, objects, or properties he is not authorized to access Authorization 8 Authorization 9 Authorization 10 Authorization J Tom can bypass business rules by altering the usual process sequence or flow, or by undertaking the process in the incorrect order, or by manipulating date and time values used by the application, or by using valid features for unintended purposes, or by otherwise manipulating control data Mike can misuse an application by using a valid feature too fast, or too frequently, or other way that is not intended, or consumes the application's resources, or causes race conditions, or a feature Richard can bypass the centralized authorization controls since they are not being used comprehensively on all interactions Dinis can access security configuration information, or access control lists
20130918180557%21OWASP-Cornucopia-Ecommerce_Website.docx