Lab: Referer-based access control

PRACTITIONER

This lab controls access to certain admin functionality based on the Referer header. You can familiarize yourself with the admin panel by logging in using administrator:admin.

To solve the lab, log in using wiener:peter and exploit the flawed access controls to promote yourself to become an administrator.

Access the lab

Solution

Browse to the admin panel, promote carlos, and send the HTTP request to Burp Repeater.

Open a private/incognito browser window, and log in with the non-admin credentials.

Browse to /admin-roles?username=carlos&action=upgrade and observe that the request is treated as unauthorized due to the absent Referer header.

Copy the non-admin user's session cookie into the existing Burp Repeater request, change the username to yours, and replay it.

Want to track your progress and have a more personalized learning experience? (It's free!)

In this topic

Access control vulnerabilities IDOR Access control security models

All topics

SQL injection XSS CSRF Clickjacking CORS XXE SSRF Request smuggling Command injection Directory traversal Access control WebSockets