---
description: >-
  https://portswigger.net/web-security/access-control/lab-referer-based-access-control
---

# Referer-based access control

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FXO8HnM6bxSWPGpvljYiJ%2F1.png?alt=media&#x26;token=f9a92120-0129-4ff5-93bb-3b94425c76a3" alt=""><figcaption></figcaption></figure>

We can login as the admin using the following credentials:

| Username      | Password |
| ------------- | -------- |
| administrator | admin    |

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2Fpter9Wu5R9AJeF29SDKJ%2F2.png?alt=media&#x26;token=ae9899ef-d6ca-4147-b5fa-6b1c77a6f882" alt=""><figcaption></figcaption></figure>

Let's go to the admin panel and upgrade the `carlos` user.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2F0Q7qkYTdzO4kpWe10sGB%2F3.png?alt=media&#x26;token=032a3d5a-2e75-4e92-ae21-b033a066daf7" alt=""><figcaption></figcaption></figure>

Since we are proxying the traffic through Burp Suite, we can go to the `Proxy > HTTP History` tab to view the request.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2Fmd2kneT3iWzj69oI2HUm%2F4.png?alt=media&#x26;token=04b98b18-3ffd-4bba-bb3b-b6decd64b461" alt=""><figcaption></figcaption></figure>

Notice that the request contains the `Refered` header set to the following:

```
https://0ab4000404f019d8885f257200e0002f.web-security-academy.net/admin
```

That tells the server that the request is coming from the `/admin` page which can only be accessed by the administrator.

Let's forward this request to the `Repeater` for further modification.

Next, let's logout and login using the following credentials:

| Username | Password |
| -------- | -------- |
| wiener   | peter    |

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FNszpYaKj3gqWCaiwL5Gq%2F5.png?alt=media&#x26;token=16b0793a-0f04-4219-a18c-715a3b04f5cf" alt=""><figcaption></figcaption></figure>

We now have to replace the session cookie in the `Repeater` tab with the `wiener` user's session cookie and set the `username` parameter to the following:

```
wiener
```

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FLzNNq3KqVvYmNBG2Jb2O%2F6.png?alt=media&#x26;token=9e2d1aad-ccc1-4f47-8fc4-e876c557ab66" alt=""><figcaption></figcaption></figure>

Since we included the `Referer` header, the server upgraded our user.

Let's check in the browser.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FLBWs8dV73PDpyFxGVoJq%2F7.png?alt=media&#x26;token=8024ebf6-f553-4b6e-a8a7-3ee3e0787d04" alt=""><figcaption></figcaption></figure>

We have solved the lab.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FqMoTNpNp5FjbSJ7NC5Vn%2F8.png?alt=media&#x26;token=5c50ad89-c5bb-4b8f-9745-5fb4d97a1111" alt=""><figcaption></figcaption></figure>
