User Role Controlled by Request Parameter

Lab#

User role controlled by request parameter · Apprentice

Solution#

Given#

This lab has an admin panel at /admin, which identifies administrators using a forgeable cookie.

Solve the lab by accessing the admin panel and using it to delete the user `carlos`.

You can log in to your own account using the following credentials: `wiener:peter`

Analyzing the task#

The admin panel uses a simple check — it looks for a specific cookie. We need to get in and delete a user.

Recon#

Let's log in and see what happens.

POST /login sets an interesting cookie:

Set-Cookie: Admin=false; Secure; HttpOnly

The obvious step — swap it for Admin=true. And indeed, the admin panel link appears.

We delete the user. Lab solved!