---
description: >-
  https://portswigger.net/web-security/access-control/lab-method-based-access-control-can-be-circumvented
---

# Method-based access control can be circumvented

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2Fzpll5qTex3Qg9IzYdo5o%2F1.png?alt=media&#x26;token=2f299528-1de9-472b-9d13-fa520128c3f2" alt=""><figcaption></figcaption></figure>

Let's login as the admin using the following credentials:

| Username      | Password |
| ------------- | -------- |
| administrator | admin    |

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FCBJIPVV3G9GbDMv6KR7e%2F2.png?alt=media&#x26;token=8c68b581-ace6-4ff1-8850-94705eeeb63a" alt=""><figcaption></figcaption></figure>

We can now upgrade the `carlos` user to admin.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2F1MG95MD9bBpDuJKfvk6M%2F3.png?alt=media&#x26;token=81f3d74a-ad9d-4a1b-850c-d02fa6c0595c" alt=""><figcaption></figcaption></figure>

Since we are proxying the traffic through Burp Suite, we will be able to view this request in the `Proxy > HTTP History` tab.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FvF4vvu9zt2e25GF1aUWK%2F4.png?alt=media&#x26;token=ab59113c-71e6-4996-af0b-d0849707694a" alt=""><figcaption></figcaption></figure>

Let's forward this request to the `Repeater` for further modification.&#x20;

Next, let's log out and log back in using the following credentials:

| Username | Password |
| -------- | -------- |
| wiener   | peter    |

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FfPDijKw42Ts3hSKMQWXd%2F5.png?alt=media&#x26;token=3bbd2528-00c9-429e-a123-23148b5075fc" alt=""><figcaption></figcaption></figure>

We can go to the `Proxy > HTTP History` tab to get the session cookie.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FLr0BIc3YfJYkTu2WyrSV%2F6.png?alt=media&#x26;token=d2f727c5-26d1-41d6-9014-28ec45f21416" alt=""><figcaption></figcaption></figure>

Now, let's go back to the `Repeater` tab and change the request method to POST.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FdHSorWBR0FC0cyP8jZI5%2F7.png?alt=media&#x26;token=c356fe3c-a932-4ab2-b032-c26a81037ba9" alt=""><figcaption></figcaption></figure>

Next, we have to replace the session cookie with the one from the `wiener` user's request. We also have to set the `username` parameter to the following:

```
wiener
```

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2F59lSsv67WB156AJVfmD1%2F8.png?alt=media&#x26;token=50e97e60-5ce8-4be8-a4b5-4a936c8bdd4a" alt=""><figcaption></figcaption></figure>

Let's go and check the browser.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FoezxUM5ODaOcEsaLfX7Q%2F9.png?alt=media&#x26;token=fb9d84ad-07b4-48d0-83be-fa1facb6679b" alt=""><figcaption></figcaption></figure>

We have solved the lab.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FiNHxwr8f6ulL8nhXDuBP%2F10.png?alt=media&#x26;token=a3261cc0-85cf-4f74-98af-109b5e41e658" alt=""><figcaption></figcaption></figure>
