> For the complete documentation index, see [llms.txt](https://ganesha-hk.gitbook.io/cybersecurity-writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ganesha-hk.gitbook.io/cybersecurity-writeups/port-swigger-access-control-labs/lab-12.md).

# lab-12

## Referer-Based Access Control

**Difficulty:** Practitioner

### Lab Description

This lab controls access to certain admin functionality based on the `Referer` header.

**Credentials (admin):** `administrator:admin`\
**Credentials (attacker):** `wiener:peter`

**Objective:** Exploit the flawed access controls to promote `wiener` to administrator.

### Root Cause

The application uses the `Referer` header to decide whether a request is authorised — if the header doesn't show the request came from `/admin`, access is denied. This is insecure because the `Referer` header is fully client-controlled and can be set to any value by an attacker. It should never be used as an authorisation mechanism.

### Exploitation

Log in as `administrator:admin`, go to the admin panel, and use the **Upgrade to admin** feature on `carlos`. Capture the upgrade request in Burp and note its structure:

```
GET /admin-roles?username=carlos&action=upgrade
```

Now log in as `wiener:peter` and capture `wiener`'s session cookie. In Repeater, send a request to the upgrade endpoint with `wiener`'s session and the username changed to `wiener`:

```
GET /admin-roles?username=wiener&action=upgrade
```

This returns an **Unauthorised** error. Add the `Referer` header to make the server believe the request originated from the admin panel:

```
Referer: https://your-lab-id.web-security-academy.net/admin
```

Send the request again. The server accepts it and upgrades `wiener` to administrator, completing the lab.

### Lesson Learned

Whenever you encounter an admin action or privileged endpoint, capture the request and check whether a `Referer` header is present. Try sending the same request with a low-privileged session and add a spoofed `Referer` pointing to the admin or privileged page. If access is granted, the application is using the `Referer` header as its only authorisation check — a trivially bypassable control.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://ganesha-hk.gitbook.io/cybersecurity-writeups/port-swigger-access-control-labs/lab-12.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.