- Application access controls based partly on HTTP method of requests
- Admin panel: administrator:admin
- Login using admin:administrator to observe admin panel
- To Solve: exploit flawed access control & elevate to administrator
- Login: wiener:peter
- Login to administrator and observe upgrading user and the HTTP requests
- Observe POST request which requests /admin-roles with the parameters of username=wiener&action=upgrade (Our upgrade paremeter)
- Login to wiener and copy session ID
- Send the POST request to repeater and change session ID to that of current user wiener
- Send altered request to server, response will be 401 unauthorized
- Change POST to POSTX will render a missing parameter “username” message
- Change response to a GET request and and the username=wiener&action=upgrade parameters immediatley after the GET (right click, change request)
- Solved
Posted by admin