> For the complete documentation index, see [llms.txt](https://ganesha-hk.gitbook.io/cybersecurity-writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ganesha-hk.gitbook.io/cybersecurity-writeups/port-swigger-access-control-labs/lab-3.md).

# lab-3

## User Role Controlled by Request Parameter

**Difficulty:** Apprentice

### Lab Description

This lab has an admin panel at `/admin`. The application identifies administrators using a forgeable cookie rather than a server-side session check.

**Objective:** Access the admin panel and delete the user `carlos`.

**Credentials:** `wiener:peter`

### Solution

**Step 1 — Log in and observe the admin cookie**

Enable Burp's interception mode. Log in as `wiener:peter` and intercept each request as it passes through. Inspect the cookies — one is named `Admin` (or similar) and is set to `false` by default.

On every intercepted request during login, change the cookie value to `Admin=true` before forwarding. After completing login, an **Admin panel** link appears in the navigation, confirming the server trusts this cookie directly.

**Step 2 — Access the admin panel**

With interception still active, click the **Admin panel** link. Again change `Admin=true` on the intercepted request before forwarding it. The backend grants admin page access based solely on this cookie value — no server-side session validation is performed.

**Step 3 — Delete carlos**

From the admin panel, delete the user `carlos` to complete the lab. Continue changing `Admin=true` on any intercepted requests if needed.

### Conclusion

The application used a client-controlled cookie to determine admin status, which any user can freely modify. Access control decisions must always be enforced server-side using the authenticated session, never based on a value the client can tamper with. This is a classic example of **vertical privilege escalation** via a forgeable parameter.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://ganesha-hk.gitbook.io/cybersecurity-writeups/port-swigger-access-control-labs/lab-3.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.