← back to room
Broken Access Control
Broken Access Control Lab
Scenario
Paid course videos unlock only when an API reports paid status true. The front end trusts that JSON field from a user-specific endpoint. Watch premium content without completing checkout.
Your approach
- Open a locked course page and inspect paid-status API calls.
- Intercept the response and change paid from false to true.
- Reload the course page with the modified client state or repeat with a proxy.
- Confirm videos unlock and the lab shows a bypass flag.
- Submit the payment bypass flag.
Find and exploit the access-control flaws:
- Hidden admin APIs — discover admin-only endpoints from intercepted traffic and hit them as a normal user.
- Privilege escalation — change your own role to admin.
- IDOR — read other users' profiles/data by id.
- Payment bypass — the "paid" check is client-side only.