Broken Access Control Lab

Home Dashboard Admin Course Login Register

Find and exploit the access-control flaws:

Hidden admin APIs — discover admin-only endpoints from intercepted traffic and hit them as a normal user.
Privilege escalation — change your own role to admin.
IDOR — read other users' profiles/data by id.
Payment bypass — the "paid" check is client-side only.

Test accounts: admin/admin123 and user1/user123.