Testing for privilege escalation - Port Swigger
Summary: PortSwigger's guide describes testing an application's access controls by holding credentials for both a high-privileged and a low-privileged account and comparing what each can reach. It covers a quick manual check in Burp Repeater using the low-privileged user's session cookie, and an automated approach that adds that cookie to all requests via a session handling rule to re-request the entire site map as the low-privileged user.
Key Takeaway: The failure mode described is simple: incorrectly set access controls let a low-privileged user reach functionality reserved for higher-privileged users, and the guide notes that testing this across a large number of endpoints is time-consuming - which is where coverage quietly gets skipped.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026