IDOR in Downloadable Chat Transcripts
Sequential transcript filenames expose an authorization gap: changing the requested object retrieves another lab user's conversation and synthetic credential.
taxonomy / tag
#portswigger
Horizontal Privilege Escalation Through a User-Controlled Account ID
Changing the account identifier in the request returns another lab user's profile, demonstrating missing object-level authorization and exposing the synthetic API key.
Privilege Escalation Through a Client-Controlled Role Cookie
The application trusts a client-controlled role cookie, so changing its value grants access to the administration panel and its privileged lab action.
Unpredictable Admin URLs Are Not Access Control
Public client-side JavaScript discloses the unpredictable administration path, and the server permits an unauthenticated visitor to use its privileged action.
Unprotected Admin Functionality: Forced Browsing to an Exposed Panel
The robots exclusion file reveals an administrative route that lacks server-side authorization, allowing direct access and the lab's deletion action.
Exploiting server-side parameter pollution in a REST URL
POST /forgot-password embeds the supplied username in an internal REST path without canonicalizing it first. Traversal segments and a URL fragment redirect the backend request to the administrator's passwordResetToken field.
Bypassing URL-Based Access Control with X-Original-URL
The front end blocks visible /admin paths, but the backend honors X-Original-URL when selecting a route. Sending an innocuous request target with the protected path in that header reaches the administrative action.
Exploiting server-side parameter pollution in a query string
Encoded query delimiters alter the internal reset API parameter set, exposing a path to retrieve the administrator reset token.
Sensitive Data Leakage in an Authorization Redirect
Requesting Carlos's account produces a redirect, but the server includes his API key in the 302 response body before the browser follows that redirect. Authorization must protect the response itself, not rely on navigation behavior.
Finding and exploiting an unused API endpoint
The product page uses GET /api/products/1/price, yet the same route also accepts an undocumented PATCH request. Setting the price to zero lets an ordinary account buy the jacket without paying its intended cost.
Password Disclosure Through a User-Controlled Account ID
The account page trusts a user-controlled id parameter and renders the selected user's password into an HTML password field. Browser masking changes only presentation: the underlying value remains available to the client.
2FA simple bypass
Direct navigation to the account page bypasses the pending second-factor step after valid password authentication.