---
description: >-
  https://portswigger.net/web-security/access-control/lab-url-based-access-control-can-be-circumvented
---

# URL-based access control can be circumvented

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FMrB7yfOzCxpd4q2yjipx%2F1.png?alt=media&#x26;token=889954cd-374a-43fc-b292-a07cd765733a" alt=""><figcaption></figcaption></figure>

Let's try to access the admin panel.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FJuwRH1f1MmGYZqolwyAp%2F2.png?alt=media&#x26;token=1c5a6927-97c6-4eb8-a089-f95eb229338d" alt=""><figcaption></figcaption></figure>

Since we are proxying the traffic through Burp Suite, we can go to `Proxy > HTTP History` to view the request.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FjLzKyqQj7fqq1eWDimYN%2F3.png?alt=media&#x26;token=f631803e-2e36-4913-af71-5b0f3e9b5331" alt=""><figcaption></figcaption></figure>

Let's forward the request to the `Repeater` for further modification.&#x20;

Once inside the `Repeater`, set the request URI to:

```
/
```

And add the following request header:

```
X-Original-URL: /admin
```

This header overrides the URI present in the original request.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FQMCxX1gsWglIHS4leqUk%2F4.png?alt=media&#x26;token=9c0b8292-35f8-4c28-ac38-6b1f99c4845f" alt=""><figcaption></figcaption></figure>

In order to delete the `carlos` user, we have to set the original URL to:

```
/?username=carlos
```

And modify the header to the following:

```
X-Original-Url: /admin/delete
```

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FVWE3EtICSY5oae5VuTff%2F5.png?alt=media&#x26;token=389fb1a2-75c9-4a45-83e8-b50a533923ec" alt=""><figcaption></figcaption></figure>

Let's go and check the panel through the browser.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FvFhATTpjMQzEpEKN33BJ%2F6.png?alt=media&#x26;token=d408f84a-ba0f-442f-a3a9-5fd4ed0a3c02" alt=""><figcaption></figcaption></figure>

We have solved the lab.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FVgDJP6lLcaq7xDcJK3i2%2F7.png?alt=media&#x26;token=25f8a50e-745a-482f-b700-d685fac57602" alt=""><figcaption></figcaption></figure>
