Ir al contenido
cyberhub.es
  • Home
  • CTFs resueltos
    • PicoCTF
      • PicoCTF 2024 writeup
  • Portswigger Lab writeup
    • Access control
    • API Testing
    • CORS
    • Cross-site scripting
    • CSRF
    • File upload
    • GraphQL API vulnerabilities
    • NoSQL injection
    • OS command injection
    • Path traversal
    • SQL injection
    • SSRF
    • Web LLM attacks
    • WebSockets
  • Home
  • CTFs resueltos
    • PicoCTF
      • PicoCTF 2024 writeup
  • Portswigger Lab writeup
    • Access control
    • API Testing
    • CORS
    • Cross-site scripting
    • CSRF
    • File upload
    • GraphQL API vulnerabilities
    • NoSQL injection
    • OS command injection
    • Path traversal
    • SQL injection
    • SSRF
    • Web LLM attacks
    • WebSockets

Categoría: Access control

User role controlled by request parameter

Descripción This lab has an admin panel at /admin, which identifies administrators using a forgeable cookie. Solve the lab by accessing the admin panel and using it to delete the user carlos. You can log in to your own account using the following credentials: wiener:peter User role controlled by request parameter writeup Al entrar en el laboratorio encontraremos […]

Unprotected admin functionality with unpredictable URL

Descripción This lab has an unprotected admin panel. It’s located at an unpredictable location, but the location is disclosed somewhere in the application. Solve the lab by accessing the admin panel, and using it to delete the user carlos. Unprotected admin functionality with unpredictable URL writeup Al entrar en la página web encontraremos una tienda online. […]

Unprotected admin functionality

Descripción This lab has an unprotected admin panel. Solve the lab by deleting the user carlos. Unprotected admin functionality writeup Al entrar encontraremos una tienda online. En principio, añadir ‘/admin’ a la URL no nos dará el panel de administrador, pero añadiendo ‘/robots.txt’ podremos ver lo siguiente: La página ‘/robots.txt’ se utiliza para decirle a los […]

← Anterior
cyberhub.es
  • Política de Cookies

Todos los derechos reservados