OWASP Security Shepherd Project - Failure To Restrict URL Access 3 ( Failure To Restrict URL Access Challenge)

Challenge

Solution

    Once again, let's click the button and use BurpSuite to check what HTTP request have we sent.

    OK, now we have currentPerson in cookie and userId as parameter. By searching online, we know that d3d9446802a44259755d38e6d163e820 is actually 10 with MD5 hashing. Also, YUd1ZXN0 is aGuest with Base64 encoding.
    It seems that there is no further information we can get, so let's check the source code as always.

    Here we find a form that could to used. Let's see what happen if we issue a post request to the URL.

    WOW!! We have the user list. Let's try to use this user list and base64 encode the user name into currentPerson to see if we could pass the challenge.
    Well, it seems that all the users are not administrative user... Maybe that is because when we requesting the user list, we are using aGuest who is a normal user in cookie. However, we don't know any administrative. user name. As a result, we could try to test if the currentPerson parameter is SQLi vulnerable. Let's try to encode "or"1"="1 with base64 and put it into currentPerson to request user list.

    By comparing the two user list, we noticed that MrJohnReillyTheSecond is only appear in the second list. He may be the administrative user we want. Let's base64 encode MrJohnReillyTheSecond and put it into the currentPerson.

    What a interesting challenge!!