[Access Control] lab 6: User ID controlled by request parameter, with unpredictable user IDs

 [Access Control] lab 6: User ID controlled by request parameter, with unpredictable user IDs

This lab is apart of my journey on to the burp suite certified practitioner.

so this lab we need to find the GUID for carlos.

First i want to vist the site:

see is anything is popping out to me.

after using the wiener:peter account username and password that was provided i was given the API key for wiener

im unsure of what to do with the API key

at first i thought it was in the post comment on the site that would contain the GUID but turn out there was nothign assoiated with the comment and a guid it was just plain HTML

but for the author post that is contianing the GUID so maybe if i fine a post from carlos i can possibly get his GUID!

i went to this post written by carlos

when going to the post i compared the GUID listed there to mine and it matches same length just different characters.

by exploiting a IDOR vulnerability i was able to get access to carlos:

and get his API key