Access Controls
Lab #4: User ID controlled by request parameter, with unpredictable user IDs
Hola 👋 welcome back. This is the Lab 4# User ID controlled by request parameter, with unpredictable user IDs write-up of the Access Control labs on WebSec Academy. This lab revolves around a horizontal privilege escalation vulnerability. The web app identifies each user with GUIDs for their user account pages. We need to locate the GUID for user Carlos and submit his API key as the solution. Let’s get started.
End Goal :#
- Find the GUID for carlos, then submit his API key as the solution.
Horizontal Privilege Escalation:
Occurs when a user is able to gain access to resources belonging to another user, instead of their own resourcesof that type.
Testing for vulnerabilities:
- The web application is a blog site where each user has posted blogs. Let’s check for a blog that the user Carlos has posted. By clicking on Carlos and checking the URL, we can identify the value of the “id” parameter associated with the user Carlos. Let’s copy it and save it for later use.
- Next, let’s log in to our own account using the following credentials: wiener:peter.
- So when I log in, we can see that I have an ID associated with my account.
- In the Repeater tab, let’s change the value of the Wiener ID to Carlos ID, which we copied earlier in the URLs, and send the request. Now, we’re logged in as user Carlos.
- and we can see his API key. Let’s copy it and submit it. With that, we’ve completed our goal.
That’s all, friends. Thank you for reading up to this point. I would like to hear your feedback on anything not clear here. Here is my Twitter account @T3chnocr4t. Feel free to DM me if you have any issues with my write-up. Thanks!