Lab: User ID controlled by request parameter
This lab has a horizontal privilege escalation vulnerability on the My Account page.
To solve the lab, obtain the API key for the user
carlos and submit it as the solution.
You can access your own account using
Log in using the supplied credentials and access "Account Details".
Note that the URL contains your username in the "id" parameter.
Send the request to Burp Repeater.
Change the "id" parameter to
Retrieve and submit the API key for