Forceful browsing (Forced Browsing ) is a web attack technique where malicious actor attempt to access resources —such as pages, files, links etc—that are not publicly linked, yet remain reachable. This attack is a good manifestation of broken access control.
The root cause of this vulnerability is inadequate authorization enforcement. When an application fails to verify permissions on every request, attackers can guess or brute-force hidden paths using common files storage directory formats — for example, /admin/, /backup/, or /config — to gain unauthorized entry to sensitive data or administrative interfaces.
Forced browsing also frequently overlaps with Insecure Direct Object References (IDOR). In these cases, an attacker manipulates a parameter in the URL—such as a user ID—to view or modify resources belonging to another user. A simple change from [ user_id=101 to user_id=106 ] may expose another individual’s private information if access control privileges are not well implemented.
Forced browsing can be reduced by:
A) Enforce authorization on every request
B) Discourage security through obscurity
C) Grant user only needed access ( least privilege access )
D) Implement centralized access-control mechanisms
These controls when implemented in the development life-cycle, organizations can reduce the risk of unauthorized data exposure through forced browsing attacks.
Thanks