User ID Controlled by Request Parameter with Data Leakage in Redirect

Lab#

User ID controlled by request parameter with data leakage in redirect · Apprentice

Solution#

Given#

This lab contains an access control vulnerability where sensitive information is leaked in the body of a redirect response.

To solve the lab, obtain the API key for the user carlos and submit it as the solution.

You can log in to your own account using the following credentials: wiener:peter

Analyzing the task#

The lab is very similar to the previous one, except that we need to find the leak in the body of the redirect to the login page.

Recon#

Log in as our user. The request:

GET /my-account?id=wiener

The response has the API key.

Okay, send a request for user carlos. The server returns 302, but the entire HTML response is present in the body:

<div>Your API Key is: ltYmzXseKRiFaVJ49joHRJQVKGVmdfbq</div>

Lab solved.