03 - User role controlled by request parameter

#accesscontrol #portswigger #writeup

Cookie: Admin=true; session=Joaj73tAW8advfQRl7lU4krjkhUomVFc

flaws.cloud

flaws2.cloud

Fortresses

Machines

AWS machines

Linux machines

Windows machines

Active Directory

NetExec Lab

LeHack2025

Writeup

Access Control

APIs

Authentication

Business Logic

Clickjacking

CORS

Practice

CSRF

DOM-Based

Practice

Theory

Essential Skills

Exams 📝

File Uploads

GraphQL

Practice

Theory

HTTP Host header

HTTP Request Smuggling

Information Disclosure

Insecure Deserialization

JWT

LLMs

NOSQLi

Oauth

Path Traversal

Prototype Pollution

Race Conditions

RCE

SQLi

SSRF

SSTI

Web Cache Deception

Web Cache Poisoning

Practice

Theory

WebSockets

XSS

XXE

Damn insecure and vulnerable App

InsecureBankV2

Theory

CMS

Active Directory

KERBEROS

03 - User role controlled by request parameter ​

03 - User role controlled by request parameter