On this page
apsyleg1 min read
#portswigger #access-control #web-security
User Role Controlled by Request Parameter
Lab
User role controlled by request parameter · Apprentice
Solution
Given
This lab has an admin panel at /admin, which identifies administrators using a forgeable cookie.
Solve the lab by accessing the admin panel and using it to delete the user `carlos`.
You can log in to your own account using the following credentials: `wiener:peter`
Analyzing the task
The admin panel uses a simple check — it looks for a specific cookie. We need to get in and delete a user.
Recon
Let's log in and see what happens.
POST /login sets an interesting cookie:
Set-Cookie: Admin=false; Secure; HttpOnly
The obvious step — swap it for Admin=true. And indeed, the admin panel link appears.
We delete the user. Lab solved!
More in this category
Arbitrary Object Injection in PHP (PortSwigger Lab)
Recovering leaked source code and injecting a serialized CustomTemplate object whose __destruct deletes an arbitrary file.
Using Application Functionality to Exploit Insecure Deserialization (PortSwigger Lab)
Tampering with the `avatar_link` field in the session object to delete an arbitrary file via the account-delete feature.
Modifying Serialized Data Types (PortSwigger Lab)
Abusing PHP loose comparison by changing the `access_token` type to integer `0` to bypass authentication.