4.3.web user id controlled by request parameter(Web Security Academy)

Web Security Academy >> Access control >> Lab

The goal is to get the API key of user carlos :

We will log in with wiener:peter .

So to get the API Key, we must go to Carlos’s page .

If you notice in the URL, the user ID appears as the user name, so we can change the name to the user Carlos .

We need to change the id from wiener to carlos

Therefore, we will send the request to the repeater :

Change the ID , And send the request :

The response came and he has already registered using the user carlos, so search in the search box for “API”.

Here we are .

Congratulations, you solved the lab!

We could have changed the ID from wiener to carlos inside the URL and see what happens , Sometimes it works, but on this site it did not work, so we logged in to the user Carlos, using burp .

See you soon in other reports….!!

Abdelwahab_Shandy

AS_Cyber