{% extends 'core/Broken Access Control/broken-access.html' %}
{% load static %}

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <title>Title</title>
</head>
{% block inside-content %}
    <div class="bg-white nav-item flex-grow bg-opacity-20 backdrop-filter backdrop-blur-md w-4/5 problems-container">
        <h1 class="text-center text-white font-bold">Now let's see some examples</h1>
        <p class="text-white pt-5">
            There are many ways to go about Broken access, but let's see the most common ones.
            <br>
            You can try them yourselves using this website. First is Forced browsing, where we will manually try to access windows, which we are not supposed to, through URLs.
            <br>
        </p>
        <p class="text-white">
            Open another instance of this website and paste this into the browser search bar:
        </p>
        <div class="flex flex-grow pb-3 pt-3">
            <pre><code class="python rounded-lg">http://127.0.0.1:8000/admin</code></pre>
            <br>
        </div>
        <p class="text-white">
            As you can see, it will take us to the admin page. This is the simplest method that allows you to gain
            access
            to places you are not meant to be. In this instance, allowing the user to see this page is not the biggest
            issue
            since frameworks like Django have built-in admin authentication. However, when we allow a user to see this
            page
            we need to be extra careful with our passwords.
            <br>
            We could also try to access specific users such as:
        </p>
        <div class="flex flex-grow pb-3 pt-3">
            <pre><code class="python rounded-lg">http://127.0.0.1:8000/admin/auth/user/5/change/

https://website.com/profile?id=1

https://website.com/index.php/view?account=1</code></pre>
            <br>
        </div>
         <p class="text-white">
             The first link is how we change user in django the other two are from different frameworks.<BR>
             Now let's see what would happen if such routes were not secured:
         </p>

        <div class="flex flex-grow pb-3 pt-3">
            <pre><code class="python rounded-lg">http://127.0.0.1:8000/problems/broken_access/user1</code></pre>
            <br>
        </div>
        <p class="text-white">
            Unprotected URLs may lead to the personal information of our users. However, this is just an example. In
            reality
            URLs would look something like the example shown above.
        </p>


    </div>
{% endblock %}
</html>