A penetration tester is testing a banking application and uncovers a vulnerability. The tester is logged in as a non-privileged user who should have no access to any data. Given the data below from…

Forced browsing occurs when an attacker directly requests URLs or resources the application intends to restrict by guessing or enumerating paths, bypassing the normal application workflow. In this scenario, the proxy data shows the non-privileged user accessing protected endpoints without going through the expected authorization flow, circumventing the application's access control logic entirely.

Parameter pollution involves sending multiple values for the same parameter in a single HTTP request to confuse application logic, which is a different technique from directly navigating to unauthorized resource URLs.

File upload vulnerabilities arise when an application allows uploading malicious files without proper validation, and have no relation to accessing unauthorized application URLs.

Cookie enumeration involves iterating or guessing session cookie values to hijack other users' sessions, not directly navigating to restricted application paths.