Lab: User ID controlled by request parameter with data leakage in redirect

APPRENTICE

This lab contains an access control vulnerability where sensitive information is leaked in the body of a redirect response.

To solve the lab, obtain the API key for the user carlos and submit it as the solution.

You can log in to your own account using the following credentials: wiener:peter

Log in using the supplied credentials and access your account page.
Send the request to Burp Repeater.
Change the "id" parameter to carlos.
Observe that although the response is now redirecting you to the home page, it has a body containing the API key belonging to carlos.
Submit the API key.

Want to track your progress and have a more personalized learning experience? (It's free!)

Find access control vulnerabilities using Burp Suite

Get started with the Web Security Academy where you can practise exploiting vulnerabilities on realistic targets .. and its free!

^{Already got an account?
Login here}

Find access control vulnerabilities using Burp Suite