-
Log in using your own credentials. Notice that the post-login
GET /my-accountrequest contains a session cookie that appears to be URL and Base64-encoded. -
Use Burp's Inspector panel to study the request in its decoded form. Notice that the cookie is in fact a serialized PHP object. The
adminattribute containsb:0, indicating the boolean valuefalse. Send this request to Burp Repeater. -
In Burp Repeater, use the Inspector to examine the cookie again and change the value of the
adminattribute tob:1. Click "Apply changes". The modified object will automatically be re-encoded and updated in the request. -
Send the request. Notice that the response now contains a link to the admin panel at
/admin, indicating that you have accessed the page with admin privileges. -
Change the path of your request to
/adminand resend it. Notice that the/adminpage contains links to delete specific user accounts. -
Change the path of your request to
/admin/delete?username=carlosand send the request to solve the lab.
Lab: Modifying serialized objects
This lab uses a serialization-based session mechanism and is vulnerable to privilege escalation as a result. To solve the lab, edit the serialized object in the session cookie to exploit this vulnerability and gain administrative privileges. Then, delete the user
carlos.
You can log in to your own account using the following credentials: wiener:peter
