Lab: User ID controlled by request parameter

APPRENTICE

This lab has a horizontal privilege escalation vulnerability on the My Account page.

To solve the lab, obtain the API key for the user carlos and submit it as the solution.

You can access your own account using wiener:peter.

Note that the URL contains your username in the "id" parameter.

Send the request to Burp Repeater.

Change the "id" parameter to carlos.

Retrieve and submit the API key for carlos.

Want to track your progress and have a more personalized learning experience? (It's free!)

SQL injection XSS CSRF Clickjacking DOM-based CORS XXE SSRF Request smuggling Command injection Server-side template injection Insecure deserialization Directory traversal Access control Authentication Web cache poisoning WebSockets