Learning OWASP A01 and A02: Broken Access Control and Security Misconfiguration

By Samyuktha

Learning the OWASP Top 10 (2025) categories Broken Access Control (A01) and Security Misconfiguration (A02) through TryHackMe labs provided valuable insights. The hands-on experience demonstrated why broken access control ranks as the top web app risk - it's not about clever exploitation but trusting the server with too much. Key concepts included IDOR (Insecure Direct Object Reference) when apps expose internal identifiers without verifying the requester owns that resource.

Missing function-level access control meant features like admin panels could be reached directly by anyone who guessed the URL. Parameter tampering allowed privilege escalation by modifying role values, while forced browsing exposed pages that shouldn't have been reachable. For security misconfiguration, mundane issues like default credentials, verbose error messages, directory listings, missing headers, outdated software, and exposed services stood out.

These are often easy wins when caught. Applying these concepts to a real production app revealed no exploitable vulnerabilities after a methodical assessment. While a clean result isn't a failed assessment, it's evidence the access control model functioned as intended under testing. The takeaway is that absence of findings is still a result worth documenting.

Good security testing isn't about finding the biggest bug, but consistently applying the checklist and being honest about what held up or didn't. Future plans include exploring A03: Injection and developing structured testing notes for a comprehensive testing checklist.