Forced Browsing

Forced or Forceful browsing is the process of enumerating the web pages that are not referenced by the web application but are still accessible. They may contain sensitive information or some kind of admin login pages which are not intended for normal users.
Brute force attack can be launched on the application by accessing unreferenced links.
Let us consider an application www.<websitename>.com
Developers do not refer the admin login page of the web application. But it can be accessed by entering the URI. Attackers can try with the following examples to get access to admin login page.
www.<websitename>.com/admin.aspx
www.<websitename>.com/admin.php
www.<websitename>.com/admin
In the above application, data of particular period can be viewed by accessing the following link which is referred in the application:
www.<websitename>.com/userdata/2014/12
Now, attackers can try to view data from different period by modifying the URI as follows:
www.<websitename>.com/userdata/2014/11
www.<websitename>.com/userdata/2014/10
To prevent forced browsing, access control must be implemented on URIs with sensitive information. 

CIA Triad Explained

Confidentiality - Integrity - Availability Triad is a security policy model.

Confidentiality: Confidentiality is protecting the information which is in rest or transit from unauthorized access and should be available only to the authorized users. Encryption ensures confidentiality of an information. Access Controls and Passwords can also be used to protect the data. Following are the common attacks on confidentiality:
Passive Attacks:
Dumpster Diving
Social Engineering
Active Attacks:
Password attacks like brute force
Using keyloggers

Integrity: Integrity ensures trustworthiness of the information. Information must remain unchanged throughout its life sustaining from intentional and accidental modifications. Integrity of an information can be achieved by hashing and encryption. Integrity can be verified by using checksums.

Common attacks on Integrity are:
Data Diddling Attacks
Salami Attacks
Man-In-The-Middle Attacks

Availability: Availability is to ensure that the data must be available to the authorized users at any point of time. Redundancy, Backups, DRP (Disaster Recovery Plan), HA (High Availability) Clusters helps in maintaining availability of information.
Attacks on availability are:
DOS (Denial of Service)
DDOS (Distributed Denial of Service)

Privilege Escalation & Types

Privilege escalation is gaining access to the resource or function which is not intended for. Escalations are mainly categorized into two.
1. Horizontal Privilege Escalation and
2. Vertical Privilege Escalation
These are detailed below
Horizontal Privilege Escalation: When the access gained is between the users of same level, we call it as horizontal escalation. For example: Alice and Bob are two users and each have their own functions. When Alice gains the functions which are private to Bob then it is a horizontal privilege escalation.
Vertical Privilege Escalation: When the access gained is between the users of different levels, it is a vertical escalation. Continuing with the previous example: Apart from Alice and Bob, there is an Administrator who takes care of administrative functions which are protected and can be accessed only by an admin. Alice successfully managed to gain the protected functions of administrator. Here, the escalation is from a normal user to an administrator with higher privileges. This is vertical privilege escalation.