User ID controlled by request parameter with password disclosure | Dec 14, 2022
Introduction
Welcome to my another writeup! In this Portswigger Labs lab, you’ll learn: User ID controlled by request parameter with password disclosure! Without further ado, let’s dive in.
- Overall difficulty for me (From 1-10 stars): ★☆☆☆☆☆☆☆☆☆
Background
This lab has user account page that contains the current user’s existing password, prefilled in a masked input.
To solve the lab, retrieve the administrator’s password, then use it to delete carlos.
You can log in to your own account using the following credentials: wiener:peter
Exploitation
Home page:
Login as user wiener:
In the previous labs, we found that the My account link is supplying an id GET parameter:
This time however, we also can see we can update our own password, and it’s prefilled in a masked input.
Hmm… Can we inspect that password?
Cool, we can see our own password.
How about using the My account link to view another user’s password? Like administrator:
To do so, I’ll use Burp Suite’s Repeater:
Now, we can view administrator’ password! bdxywccjia4y27fb9yty. Let’s login as administrator and delete user carlos!
We found the Admin panel!
What we’ve learned:
- User ID controlled by request parameter with password disclosure