🕵‍♂️Info:

This lab has an admin panel with a flawed multi-step process for changing a user's role. You can familiarize yourself with the admin panel by logging in using the credentials administrator:admin.

🎯 Goal:

To solve the lab, log in using the credentials wiener:peter and exploit the flawed access controls to promote yourself to become an administrator.

First We have misconfiguration in one step

1. login as administrator with cerd
2. Observe requests when you will upgrade carlos
3. you will see 3 requests

1. 2 of this requests have the same endpoint so i will open 2 requests to know the diffrenet
2. from website we know this lab need a confirmed step from admin to upgrade any user
3. so now we need to upgrade wiener our account to administrator
4. login as wiener : peter
5. and catch the request /my-account?id=wiener
6. and copy wiener session
7. Go to the request for check and replace administrator session with wiener
8. and now replace username from carlos → wiener
9. send the request and click on follow redirection