📌 info:
This lab has user account page that contains the current user's existing password, prefilled in a masked input.
🎯 Goal:
To solve the lab, retrieve the administrator's password, then use it to delete the user carlos.
You can log in to your own account using the following credentials: wiener:peter
- Log in with the credentials:
wiener:peter. 🔐
- Start your proxy/interceptor (Burp, OWASP ZAP, or similar) and enable interception. 🕵️♂️
- Open the account page for your user so the request/response is captured. 🔁
- Inspect the response for the account page — the existing password will be present (masked in the UI but visible in the response). 📍
- Send the request to Repeater (or manually edit the intercepted request). ✍️
- change the
id parameter from your username to administrator (for example id=wiener → id=administrator). 🔄
- Forward the edited request or follow the redirect to view the response. ➡️🔍
- Inspect the response body to find the administrator’s password.
- Log out of the web app and log in as
administrator using the recovered password. 🔐
- Go to the admin panel and delete the user
carlos. 🗑️
- Submit the lab as solved once
carlos is deleted. 🏁
