OWASP Security Shepherd Project - Failure To Restrict URL Access 2 ( Failure To Restrict URL Access Challenge)

Challenge

Solution

    As usual, let's click at the Get Guest Info button to see what would happen.

    OK, pretty boring stuff... Let's see what's the http request we sent when clicking the button.

    It seems that we use POST request with guestData as parameter when clicking the button. Let's further check the source code to see if there is any clue left.

    We find "ismcoa98sUD8j21dmdoasmcoISOdjh3189|guestData|278fa30ee727b74b9a2522a5ca3bf993087de5a0ac72adff216002abf79146fa|leAdministratorFormOfAwesomeness|278fa30ee727b74b9a2522a5ca3bf993087de5a0ac72adff216002abf79146fahghghmin|adminData|youAreAnAdminOfAwesomenessWoopWoop" in the eval() function.
    Since guestData, ismcoa98sUD8j21dmdoasmcoISOdjh3189 and 278fa30ee727b74b9a2522a5ca3bf993087de5a0ac72adff216002abf79146fa are exactly the same as the parameter with value and URL we send when clicking the button, it is not difficult to guess adminData, youAreAnAdminOfAwesomenessWoopWoop and 278fa30ee727b74b9a2522a5ca3bf993087de5a0ac72adff216002abf79146fahghghmin are exactly the URL and parameter with value for administrative page.
    As a result, we could use these information to make a POST request to server.

  
    Not bad : -)