Post

Access control - UID controlled by request parameter

Posted Updated
Preview Image
By Charalampos Spanias 1 min read

Objective: This lab has a horizontal privilege escalation vulnerability on the user account page. To solve the lab, obtain the API key for the user carlos and submit it as the solution. You can log in to your own account using the following credentials: wiener:peter.

  1. When we login with the account wiener, we are given his API key:

  2. If we change the id parameter to carlos we will be able to get his API key and submit our solution:

PortSwigger, Lab
portswigger lab access_control burp
This post is licensed under CC BY 4.0 by the author.