Forge the admin role

Privilege Escalation & Post-Exploitation Difficulty ~3 min +10 XP

Here is the request the app sends to load your account panel. Notice it tells the server your own role, right there in the query. The server believed it. Change the role, send it, and read the admin-only note the response leaks.

Play freely - sign up to submit your answer and earn XP.