---
description: >-
  https://portswigger.net/web-security/access-control/lab-multi-step-process-with-no-access-control-on-one-step
---

# Multi-step process with no access control on one step

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FJ5i58D7UtoGTzhcNRyCy%2F1.png?alt=media&#x26;token=4da40307-1de5-4bc7-b504-8cf757f5bd9a" alt=""><figcaption></figcaption></figure>

Let's login as the admin using the following credentials:

| Username      | Password |
| ------------- | -------- |
| administrator | admin    |

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FZZOarwju6ttFi6Vtf3GD%2F2.png?alt=media&#x26;token=2755f226-79ee-4710-81d0-2b336d62305f" alt=""><figcaption></figcaption></figure>

Let's now promote the `carlos` user to admin.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FMT7uEgUnZEVL0bZ4vEGE%2F3.png?alt=media&#x26;token=d768dbc1-7b4e-496e-87fc-b0ca656e7d05" alt=""><figcaption></figcaption></figure>

Since we are proxying the traffic through Burp Suite, we can view this request in the `Proxy > HTTP History` tab.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FmHlZ5kNPNoyzNZwuw1ui%2F4.png?alt=media&#x26;token=a0fb366d-1a33-4b2f-8008-ad3af090698c" alt=""><figcaption></figcaption></figure>

Let's forward this request to the `Repeater` for further modification.&#x20;

Next, let's login using the following credentials:

| Username | Password |
| -------- | -------- |
| wiener   | peter    |

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FZD8dOX4mFKXpyUz3OJUl%2F5.png?alt=media&#x26;token=0f622d68-57de-4439-b0cb-24c1f8064e12" alt=""><figcaption></figcaption></figure>

Let's view the session cookie in the `Proxy > HTTP History` tab.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FlMtPN2oHYYU8WMnNTV8j%2F6.png?alt=media&#x26;token=0e473026-e098-439b-820f-61990526b586" alt=""><figcaption></figcaption></figure>

We now have to replace the session cookie in the `Repeater` tab with the `wiener` user's session cookie.&#x20;

We also have to the set the `username` parameter to the following:

```
wiener
```

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2F341GYUuwr3b5qc8yV3sD%2F7.png?alt=media&#x26;token=476603e9-c63e-475e-8f31-5f3352b056b5" alt=""><figcaption></figcaption></figure>

Let's go check in the browser.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2F44ovzCWmReJNTAPt2LrO%2F8.png?alt=media&#x26;token=298a55f3-a08e-4e21-b891-f8669cea3642" alt=""><figcaption></figcaption></figure>

We have solved the lab.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FNmcV9WRRqi2io0XDRdLU%2F9.png?alt=media&#x26;token=556178fc-0298-493b-9084-53064a235d99" alt=""><figcaption></figcaption></figure>
