7.6 Lab: Method-based access control can be circumvented | 2024

This lab implements access controls based partly on the HTTP method of requests. You can familiarize yourself with the admin panel by logging in using the credentials administrator:admin.

To solve the lab, log in using the credentials wiener:peter and exploit the flawed access controls to promote yourself to become an administrator.

Log in to the Admin Account and click the Admin PanelChoose Carlos, Click Upgrade, Capture the request and send it to Repeater.Logout from the Account, Log in to wiener Account and capture the request of My-Account or Anything which consists of Wiener’s Session Cookie.Copy that Session, go to the repeater, and paste the session into the request that we captured from the Admin’s Account.Change the Value of the username to wiener, Right click on the request, click Change request Method, and send the request.The Lab will be solved then.