4.6.web user role controlled by request parameter(Web Security Academy)

Web Security Academy >> Access control >> Lab

Well, I checked the robots.txt file, and also the code for the site, and also guessed the hidden directory, but in the end I did not find anything, so we will use burp , But in the end we must access the admin panel ؟؟

So we tried adding /admin. We might achieve something, but:

First of all, you must log in using “ wiener:peter ”.

But I found the message “Admin interface is only available if you are logged in as administrator”

I will run intercept in burp , I will try again, adding admin again and narrating the request and it is going to the server :

This series contains two cookies:

“Admin=false”: This cookie indicates that the current user is not a system administrator. A value of “false” indicates that he is not a manager.\  “session=0dl420TfDQJuY2vIiMv6ZCC8W0z2wPAs”: This cookie is used to set the user’s session. This cookie is supposed to contain a session identifier that is used to identify the user and allow them to access appropriate content in the application.

So, if we change the value of “false” to “true”, will it then make me go to the admin panel? Let’s try.

Cookie: Admin=false; session=0dl420TfDQJuY2vIiMv6ZCC8W0z2wPAs

We have already changed the value and it has already entered the admin panel :

Cookie: Admin=true; session=0dl420TfDQJuY2vIiMv6ZCC8W0z2wPAs

Well, we have already reached the admin panel :

But I ran into a problem when I deleted the user Carlos. He refused to do so. It seems that he checks the cookies on every request the user makes for that , We will do the following :

You will open the proxy settings .

After that, go to match and replace rules , You will add a new part as follows :

After this point and adding it from the burp, the curator will enable you to delete the user without stopping the request and modifying it:

See you soon in other reports….!!

Abdelwahab_Shandy

AS_Cyber