> For the complete documentation index, see [llms.txt](https://ganesha-hk.gitbook.io/cybersecurity-writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ganesha-hk.gitbook.io/cybersecurity-writeups/port-swigger-access-control-labs/lab-7.md). # lab-7 ## User ID Controlled by Request Parameter with Unpredictable User IDs **Difficulty:** Apprentice ### Lab Description This lab has a horizontal privilege escalation vulnerability on the user account page, but users are identified by GUIDs rather than predictable usernames, making direct parameter guessing impractical. **Objective:** Find the GUID for `carlos`, then submit his API key as the solution. **Credentials:** `wiener:peter` ### Solution **Step 1 — Identify the GUID-based account URL** Log in as `wiener:peter` and capture the requests in Burp. The account page URL looks like: ``` GET /my-account?id= ``` The GUID is not guessable. However, the same vulnerability exists as in the previous lab — the back-end doesn't validate whether the session matches the requested ID. The challenge is finding Carlos's GUID. **Step 2 — Find a place where GUIDs are disclosed** The application likely displays author information on blog posts or other content pages. GUIDs assigned to users are often embedded in author links in the page source. Browse the site and inspect blog posts or comments for any authored by `carlos`. Open the page source and search for `carlos`. An author link will contain his GUID: ```html carlos ``` Copy the GUID from the `userId` parameter. **Step 3 — Access carlos's account using his GUID** In Repeater, replace `id=wiener-guid` with `id=carlos-guid`: ``` GET /my-account?id=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx ``` Optionally remove the session cookie to confirm it isn't being validated. The server returns Carlos's account page, including his API key. Submit the key to complete the lab. ### Conclusion Using GUIDs instead of sequential or username-based IDs makes parameter values harder to *guess*, but they are not secret. GUIDs are regularly embedded in public-facing content (author links, comment metadata, shared URLs) where they can be harvested. The real fix is server-side enforcement: validate that the authenticated session belongs to the account being requested, regardless of how unpredictable the ID is. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://ganesha-hk.gitbook.io/cybersecurity-writeups/port-swigger-access-control-labs/lab-7.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.