Forced Browsing

Also Known As

TL;DR

Explanation

Forced browsing (also called direct object reference or insecure direct access) occurs when an attacker guesses or enumerates URLs for resources the application assumes are private due to obscurity — backup files, admin panels, uploaded files, API endpoints, or configuration dumps. The fix is never to rely on URL secrecy: every resource must enforce server-side authorisation regardless of how it is accessed. Tools like dirb, gobuster, and OWASP ZAP automate forced browsing discovery during pen tests.

Common Misconception

Why It Matters

Common Mistakes

• Generating download URLs or IDs sequentially — attackers enumerate ±1 from any known ID.
• No server-side authorisation check on direct file or resource requests — only the link is hidden.
• Backup files, old scripts, or admin panels deployed to the webroot and forgotten.
• Relying on robots.txt to hide admin paths — it advertises them to attackers.

Code Examples

// No ownership check — any user can download any invoice
public function download(string \$filename): Response {
    return response()->file(storage_path("invoices/\$filename"));
}

// Use ID, not filename — enforce ownership
public function download(int \$invoiceId): Response {
    \$invoice = Invoice::findOrFail(\$invoiceId);

    if (\$invoice->user_id !== auth()->id()) abort(403);

    return response()->file(
        storage_path("invoices/{\$invoice->stored_filename}"),
        ['Content-Disposition' => "attachment; filename=invoice-\$invoiceId.pdf"]
    );
}

References

• ↗ https://owasp.org/www-community/attacks/Forced_browsing

Tags

Related Terms