Scribd
Upload
189 views3 pages

Unprotected Admin Functionality Lab

The document describes how a user exploited unprotected admin functionality on a website. They were able to edit the GET request to access the administrator panel where they should not have access. Once in the admin panel, the user was able to delete another user named Carlos, demonstrating the security risk of including sensitive data in GET/POST/PULL requests that can be manipulated.

Uploaded by

DODOXD Mekheimer
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
189 views3 pages

Unprotected Admin Functionality Lab

The document describes how a user exploited unprotected admin functionality on a website. They were able to edit the GET request to access the administrator panel where they should not have access. Once in the admin panel, the user was able to delete another user named Carlos, demonstrating the security risk of including sensitive data in GET/POST/PULL requests that can be manipulated.

Uploaded by

DODOXD Mekheimer
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd

Lab 1-Unprotected Admin Functionality

Ahmed Khaled Saad Ali ID:1809799


Screenshots:
Clicked “My Account”

Edited GET Request & Forwarding

It opens another GET Request we will replace it with “/administrator-panel” as


well and forward it
We obtained admin panel and we delete carlos

Lessons:
1. Don’t include sensitive data/info in GET/POST/PULL requests

You might also like