OWASP Security Shepherd Project - Failure to Restrict URL Access Lesson

What is Failure to Restrict URL Access Vulnerability/Threat?

    Failure to restrict URL access occurs in applications hide functionality from non-privileged users. In an application that fails to restrict URL access, administration links are only put onto the page if the user is an administrator. However, if non-privileged users discover the administration page's address, they can still access it via URL access.
    Preventing unauthorized URL access requires selecting an approach for requiring proper authentication and proper authorization for each page. The easier the authentication is to include in a page the more likely that all pages will be covered by the policy.

Lesson

     In this lesson, we need to try access the administrators only web page. The first thing come to my mind is if we could find the web address in the source code? As a result, let's view the source code.


    We are right! Here comes the Administrator Result Page! Let change the display: none to be display:block.


    Here comes the link of Administrator Result Page! By clicking the link, we could have the Result Key and this complete our lesson.