1. Web Security Academy
  2. Business logic vulnerabilities
  3. Examples
  4. Lab

Lab: Authentication bypass via flawed state machine

PRACTITIONER

This lab makes flawed assumptions about the sequence of events in the login process. To solve the lab, exploit this flaw to bypass the lab's authentication, access the admin interface, and delete Carlos.

You can access your own account using the following credentials: wiener:peter