---
description: >-
  https://portswigger.net/web-security/access-control/lab-user-id-controlled-by-request-parameter-with-password-disclosure
---

# User ID controlled by request parameter with password disclosure

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2F1e8xZapDijWKKPFHdYr4%2F1.png?alt=media&#x26;token=34258bb0-d094-4f57-856f-03a5f6eb13a3" alt=""><figcaption></figcaption></figure>

Let's login using the following credentials:

| Username | Password |
| -------- | -------- |
| wiener   | peter    |

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FXs6MKvIoHkNd81NQyx0d%2F2.png?alt=media&#x26;token=976b1f9e-9d50-403f-b6e9-7e1f59dceca2" alt=""><figcaption></figcaption></figure>

We can see that the password is included in the input field for resetting the password. However this password is hidden.&#x20;

Let's view this in the `Proxy > HTTP History` tab.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FOOscGEom0Jmom9ZSyztT%2F3.png?alt=media&#x26;token=71902f89-e4d7-4b9b-9627-58a366ea454d" alt=""><figcaption></figcaption></figure>

We can clearly see the value of the password. We can view the administrator's password in a similar manner. Let's forward the request to the `Repeater` and set the `id` parameter to the following:

```
administrator
```

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FM6sYhy3I5gmUnyftiIvD%2F4.png?alt=media&#x26;token=82fd8dae-ae32-449e-8b94-0f36d0624093" alt=""><figcaption></figcaption></figure>

Now we can login as the administrator using the following credentials:

| Username      | Password             |
| ------------- | -------------------- |
| administrator | eg9yjeq3lztdlfb0bnay |

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2Fuwajrk0Bdsw5ES7G0QXZ%2F5.png?alt=media&#x26;token=651a3779-52c5-4f95-905c-917828c1e888" alt=""><figcaption></figcaption></figure>

We now have access to the admin panel.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2F3txDo69urZjTeEbRiWFd%2F6.png?alt=media&#x26;token=180977a9-0ef9-4616-9b5d-2d84f18198c6" alt=""><figcaption></figcaption></figure>

Let's delete the `carlos` user.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2F2pPOLPk2qfAhf3FjRafC%2F7.png?alt=media&#x26;token=bc68bf4a-e94d-469a-a528-c7b7aa23f54f" alt=""><figcaption></figcaption></figure>

We have solved the lab.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2F2dWxh5kMdWL5IRLNoHiT%2F8.png?alt=media&#x26;token=2eb65073-5673-4986-9ca9-3e977e7e3df1" alt=""><figcaption></figcaption></figure>
