4.4.15 web user id controlled by request parameter with dynamic id(Web Security Academy)

Web Security Academy >>Access control >> Lab

The goal here is to access Carlos’s API, so we have to access his GUIDs :

If, after collecting information before starting anything about this site, you will know that it is a blogs site more than anything that is just posts, and each post is written by a specific user. Therefore, you will find that the number of users is 3, and that each user actually has his own GUIDs. , So :

When you browse around, you will find that each post has a specific ID .

So I will register the login using wiener:peter, then tell the userId from within the wiener user page, and will it really be the same as the user’s blogs?

Same user id .

Here inside the page for the user wiener .

Same user id .

Here inside the blogs .

So we can go back to the My Account page, and change the user ID :

This is carlos’s user id , We found him by finding the post, and thus we found his user ID :

We will change the user ID from here, and test whether it will actually take me to Carlos’s page .

Indeed, what was expected happened and I arrived at Carlos’s page .

Congratulations, you solved the lab!

We can also do all this using burp. Try it, it will be really fun .

See you soon in other reports….!!

Abdelwahab_Shandy

AS_Cyber