---
description: >-
  https://portswigger.net/web-security/access-control/lab-user-id-controlled-by-request-parameter-with-data-leakage-in-redirect
---

# User ID controlled by request parameter with data leakage in redirect

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2F7ZFxIYBqcwBVULDTA9h2%2F1.png?alt=media&#x26;token=797b4dee-3470-4e96-9110-51176c1e0610" alt=""><figcaption></figcaption></figure>

Let's login using the following credentials:

| Username | Password |
| -------- | -------- |
| wiener   | peter    |

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FJ4Y8kd27Px4YmxhjOyQd%2F2.png?alt=media&#x26;token=01919207-ca13-4e53-8d6c-82eef76970e2" alt=""><figcaption></figcaption></figure>

Since we are proxying the traffic through Burp Suite, we will be able to view the request in `Proxy > HTTP History`.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FfMZZ15k77MBtxpSiBJWA%2F3.png?alt=media&#x26;token=63eded09-3e01-4ad9-a1dd-0c65287613a2" alt=""><figcaption></figcaption></figure>

We can see that the URI contains the `id` parameter set to `wiener`.&#x20;

Let's forward it to the `Repeater` for further modification.&#x20;

Once in the `Repeater`, we can set the `id` parameter to the following and send the request:

```
carlos
```

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FdnTDuDk5jMcddKiXGpE6%2F4.png?alt=media&#x26;token=88897ced-9f10-40cd-8969-a4830fb5d384" alt=""><figcaption></figcaption></figure>

As we can see the response contains a 302 code. Which means that this is a redirection response.&#x20;

We can follow the redirection however it is not necessary since we have the API key. Let's submit the key.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FNYmoTKyoQWhQhWXCOdbT%2F6.png?alt=media&#x26;token=cb531e1f-947f-40a2-9607-91192c6010de" alt=""><figcaption></figcaption></figure>

We have solved the lab.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FPSTpnm0SKc6eOJKwBZCH%2F7.png?alt=media&#x26;token=966ca46a-764f-4d4e-9deb-47752d4b8b9f" alt=""><figcaption></figcaption></figure>
