Authentication bypass via flawed state machine¶

Description¶

This lab makes flawed assumptions about the sequence of events in the login process.

With Burp running, complete the login process with wiener:peter and notice that you need to select your role before you are taken to the home page.
Use the content discovery tool to identify the /admin path.
Try browsing to /admin directly from the role selection page and observe that this doesn’t work.
Log out and then go back to the login page. In Burp, turn on proxy intercept then log in.
Forward the POST /login request. The next request is GET /role-selector. Drop this request and then browse to the lab’s home page. Observe that your role has defaulted to the administrator role, and you have access to the Admin panel.
Delete Carlos to solve the lab.

An attacker will need to log in; exploit the flaw to bypass the lab’s authentication, access the admin interface, and delete Carlos.