On this page
apsyleg1 min read
#portswigger #access-control #web-security
User ID Controlled by Request Parameter with Data Leakage in Redirect
Lab
User ID controlled by request parameter with data leakage in redirect · Apprentice
Solution
Given
This lab contains an access control vulnerability where sensitive information is leaked in the body of a redirect response.
To solve the lab, obtain the API key for the user carlos and submit it as the solution.
You can log in to your own account using the following credentials: wiener:peter
Analyzing the task
The lab is very similar to the previous one, except that we need to find the leak in the body of the redirect to the login page.
Recon
Log in as our user. The request:
GET /my-account?id=wiener
The response has the API key.
Okay, send a request for user carlos. The server returns 302, but the entire HTML response is present in the body:
<div>Your API Key is: ltYmzXseKRiFaVJ49joHRJQVKGVmdfbq</div>
Lab solved.
More in this category
Arbitrary Object Injection in PHP (PortSwigger Lab)
Recovering leaked source code and injecting a serialized CustomTemplate object whose __destruct deletes an arbitrary file.
Using Application Functionality to Exploit Insecure Deserialization (PortSwigger Lab)
Tampering with the `avatar_link` field in the session object to delete an arbitrary file via the account-delete feature.
Modifying Serialized Data Types (PortSwigger Lab)
Abusing PHP loose comparison by changing the `access_token` type to integer `0` to bypass authentication.