Authorization disclaimer. This walkthrough is exclusively for the intentionally vulnerable PortSwigger Web Security Academy lab linked below. Only test systems you own or are explicitly authorized to assess.

Overview

This lab moves from missing controls to a broken control: the server decides whether a user is an administrator from the browser-controlled Admin cookie.

PortSwigger client-controlled role lab introduction
The Admin cookie objective is vertical privilege escalation from the wiener account.

Lab objective/setup

Sign in with the synthetic credentials wiener:peter, obtain admin access, and delete carlos.

What I observed

Direct access to /admin was denied. After login, an intercepted request contained Admin=false, indicating that a security decision might depend on mutable client data.

Access denied response for the admin page
The wiener account initially receives no access to /admin.
Burp request showing Admin false cookie
The account request exposes the client-controlled Admin role cookie.

Why it is vulnerable

Cookies are user input. Unless a value is integrity-protected and tied to authoritative server-side state, the server cannot trust it to grant privileges. Here, changing one Boolean alters authorization.

Walkthrough in the authorized PortSwigger lab

  1. Log in as wiener and intercept an authenticated request.
  2. Change Admin=false to Admin=true within the lab session.
  3. Request /admin, then delete carlos using the lab interface.
Modified request with Admin true cookie
The /admin request is replayed after changing the Admin cookie to true.
Administrator panel exposed after cookie modification
The server accepts the client-asserted administrator role.
Delete control used for Carlos in the lab
The escalated session can invoke the administrative action.
Solved status for role cookie lab
The solved banner verifies completion after deleting the carlos account.
Authenticate as `wiener`, intercept the account request, change the `Admin` cookie from `false` to `true`, then request `/admin`. Delete `carlos` through the authorized lab panel and verify the solved state.

Verification

The panel becomes available only after modifying the cookie, and the Academy reports the lab solved after deletion. These observations isolate the trusted role flag as the failure.

Impact and defensive lesson

This pattern enables vertical privilege escalation. Store roles in server-side session state or derive them from an authoritative identity store, and authorize every sensitive endpoint.

References