📌 info :

This lab contains an access control vulnerability where sensitive information is leaked in the body of a redirect response

🎯Goal :

To solve the lab, obtain the API key for the user carlos and submit it as the solution.

You can log in to your own account using the following credentials: wiener:peter

• Log in with credentials: wiener:peter. 🔐
• Start your proxy/interceptor (Burp, OWASP ZAP, or similar) and enable interception. 🕵️‍♂️
• Perform an action that triggers a redirect or request containing a id parameter

• Locate the request where the ID parameter equals your user (wiener). 📍
• Send the request to Repeater (or manually edit the intercepted request). ✍️
• Change the id parameter from wiener to carlos (e.g., id=wiener → id=carlos). 🔄

• Follow the redirect or forward the edited request and inspect the redirect response. ➡️🔍
• Inspect the response body (and headers). The leaked API key for carlos should appear. 🧾
• Copy the API key and submit it in the lab’s solution field. 🏁