HTML disabled buttons¶

root-me challenge: HTML - disabled buttons: This form is disabled and can not be used. It’s up to you to find a way to use it.

Set disabled to enabled.

Techniques¶

• Broken access control

• Access control testing runbook

Counter moves¶

HTML disabled buttons is the case here. A client-side finding still needs a server-side control behind it. Defenders’ notes on this are under the application layer as a target.