1. Web Security Academy
  2. Business logic vulnerabilities
  3. Examples
  4. Lab

Lab: Authentication bypass via flawed state machine


This lab makes flawed assumptions about the sequence of events in the login process. To solve the lab, exploit this flaw to bypass the lab's authentication, access the admin interface, and delete Carlos.

You can log in to your own account using the following credentials: wiener:peter