← back to room
Broken Access Control
Broken Access Control Lab
Scenario
The student dashboard includes a form that updates your role label. The server applies whatever role value you POST without verifying eligibility. Promote yourself to admin and open the admin panel.
Your approach
- Locate the role update form or endpoint on the dashboard.
- POST role set to admin while authenticated as a student.
- Navigate to admin-only pages now visible in the UI.
- Read secret_flag from admin settings.
- Submit the admin panel flag.
Find and exploit the access-control flaws:
- Hidden admin APIs — discover admin-only endpoints from intercepted traffic and hit them as a normal user.
- Privilege escalation — change your own role to admin.
- IDOR — read other users' profiles/data by id.
- Payment bypass — the "paid" check is client-side only.