← back to room
Broken Access Control
Broken Access Control Lab
Scenario
LearnHub exposes JSON admin endpoints alongside student routes. You are logged in as an ordinary student with no elevated role. Discover and call hidden admin APIs to retrieve a sensitive key.
Your approach
- Log in as the demo student and browse dashboard network traffic.
- Fuzz or guess paths under the api admin namespace.
- Request admin keys or settings without an admin session.
- Copy the admin API key flag from the JSON response.
- Submit that flag.
Find and exploit the access-control flaws:
- Hidden admin APIs — discover admin-only endpoints from intercepted traffic and hit them as a normal user.
- Privilege escalation — change your own role to admin.
- IDOR — read other users' profiles/data by id.
- Payment bypass — the "paid" check is client-side only.