User role controlled by request parameter

🎯 Objective

This lab has an admin panel at /admin, which identifies administrators using a forgeable cookie.

Goal:

• Modify the cookie to gain admin access.
• Use the admin panel to delete the user carlos.

📝 Provided Information

• Credentials:
  text Copy

  wiener:peter

🔎 Analysis

Step 1: Login as Wiener

Logged in using the provided credentials and inspected parameters sent to the server:

Step 2: Inspect the Cookie

Noticed the following cookie:

Cookie: session=kQ9RdeA6ycyGdQDmgqZgYxt7wOlWSLPk; Admin=false

The Admin=false flag looked suspicious.

Step 3: Modify the Cookie

Changed the value to:

Cookie: session=kQ9RdeA6ycyGdQDmgqZgYxt7wOlWSLPk; Admin=true

Now the server exposed a new route: /admin

Step 4: Persist the Value

Updated local session storage in the browser to always append the parameter as true:

Step 5: Access the Admin Panel

Navigated to /admin:

Gained full access to the admin panel.

🎉 Result

• Successfully forged the Admin=true cookie.
• Accessed the admin panel.
• Deleted the user carlos. ✅

💡 Key Takeaway

Always review parameters sent to the server.
Seemingly minor flags like Admin=false may directly control access levels.
In this case, flipping it to true granted administrative privileges.