---
description: >-
  https://portswigger.net/web-security/access-control/lab-user-role-controlled-by-request-parameter
---

# User role controlled by request parameter

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2F0aWVwCZliV0ocEsMdt9f%2F1.png?alt=media&#x26;token=9df1f816-c94d-4e8d-8aad-0551ad7b4c20" alt=""><figcaption></figcaption></figure>

We can login using the following credentials:

| Username | Password |
| -------- | -------- |
| wiener   | peter    |

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2Fo3oYslECagCAXROIJrCR%2F2.png?alt=media&#x26;token=d60285c0-0247-4d23-a231-075eec671ff4" alt=""><figcaption></figcaption></figure>

Since we are proxying the traffic through Burp Suite, we can see this request in the `Proxy > HTTP History` tab.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2Fih162VdLSlBIPGKJuZYW%2F3.png?alt=media&#x26;token=6fe0a163-8387-47db-9970-70dccefd588c" alt=""><figcaption></figcaption></figure>

As we can see, the response sets an `Admin` cookie to `false`.&#x20;

In the next request, we can see that the cookie is used in the header.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FkVmFsxYtJXDGGJceN8GM%2F4.png?alt=media&#x26;token=621966ae-06bf-4475-a589-ecd5eac02e61" alt=""><figcaption></figcaption></figure>

Let's go into the browser `Developer Tools > Storage` and set the `Admin` cookie to `true`.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FlbGZGQmT4HtzLgj5XHIK%2F8.png?alt=media&#x26;token=bd3b251c-70e0-4246-a302-b94f6afbd81f" alt=""><figcaption></figcaption></figure>

We can now refresh the page.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FO73FCJ1lAZfM7f0ard4i%2F6.png?alt=media&#x26;token=33243430-8f60-4e9c-adde-ed459d357143" alt=""><figcaption></figcaption></figure>

We now have access to the admin panel.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2F8FTKxYEXskfr4JLnD1S7%2F7.png?alt=media&#x26;token=7e8c2f35-1bc2-4d87-8982-f31fea04048b" alt=""><figcaption></figcaption></figure>

Let's delete the `carlos` user.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2F3Q0EAuQcGpZG8Gf7XRhB%2F9.png?alt=media&#x26;token=3f712341-6863-4b0b-8de7-71580ce0e8c9" alt=""><figcaption></figcaption></figure>

We have solved the lab.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2Frgd6OlvNyTzlevwHJq7P%2F10.png?alt=media&#x26;token=45293e21-8489-434e-8d57-4ebd84f0ad10" alt=""><figcaption></figcaption></figure>
