Scribd Logo
Upload

Welcome to Scribd!

  • Lab 1-Unprotected Admin Functionality

    Uploaded by

    DODOXD Mekheimer
    81 views3 pages
    The document describes how a user exploited unprotected admin functionality on a website. They were able to edit the GET request to access the administrator panel where they should not have access. Once in the admin panel, the user was able to delete another user named Carlos, demonstrating the security risk of including sensitive data in GET/POST/PULL requests that can be manipulated.

    Original Description:

    Copyright

    © © All Rights Reserved

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    Report this Document
    The document describes how a user exploited unprotected admin functionality on a website. They were able to edit the GET request to access the administrator panel where they should not have access. Once in the admin panel, the user was able to delete another user named Carlos, demonstrating the security risk of including sensitive data in GET/POST/PULL requests that can be manipulated.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Flag for inappropriate content
    81 views3 pages

    Lab 1-Unprotected Admin Functionality

    Uploaded by

    DODOXD Mekheimer
    The document describes how a user exploited unprotected admin functionality on a website. They were able to edit the GET request to access the administrator panel where they should not have access. Once in the admin panel, the user was able to delete another user named Carlos, demonstrating the security risk of including sensitive data in GET/POST/PULL requests that can be manipulated.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Flag for inappropriate content
    of 3

    Lab 1-Unprotected Admin Functionality

    Ahmed Khaled Saad Ali ID:1809799


    Screenshots:
    Clicked “My Account”

    Edited GET Request & Forwarding

    It opens another GET Request we will replace it with “/administrator-panel” as


    well and forward it
    We obtained admin panel and we delete carlos

    Lessons:
    1. Don’t include sensitive data/info in GET/POST/PULL requests

    You might also like