标签：#accesscontrol

I spent six hours trying to upgrade a non-admin user to admin, convinced I was missing some clever bypass. The gap turned out to be one field in a request body I'd already looked at twice. This is a PortSwigger lab on multi-step process access control. The setup: an admin panel with a user upgrade flow. You pick a user, hit upgrade, then confirm on a second screen before the change actually goes through. Not counting the admin login and accessing the admin panel, that's two steps. The goal was to login as wiener (my non-admin account) and upgrade it to admin without ever having admin access to begin with. Fig 1. A quick look at the admin interface in action. What I tried that didn't work I followed and wrote out the steps the admin flow actually takes, so I could inspect each step individually. Checked the change-email route for anything reusable. Tried hitting the admin and admin-roles paths directly with different HTTP methods. Added the referrer header with the value I'd seen during the legitimate admin flow. Went through the HTML and JS on every relevant page. Tried looking for where the user list was being fetched from. Tried the user-ID-in-params trick that had worked on an earlier lab. None of this brought any results and just got me more frustrated. The thing is, I was going at this problem with the assumption that in this scenario, I was a hacker with no idea of how the admin system actually worked when upgrading users. And that the lab giving me access to the admin credentials was just to hint towards any probable vulns. Why I slipped into that line of thinking, I have no idea. As I watched the hours tick by on my laptop clock, I grew increasingly aware of the painful fact that some LLM somewhere could probably one-shot this problem. That I could end my suffering by taking a knee before the mighty oracle called Claude. And you as a reader are probably wondering why I didn't submit. Well I was determined to actually learn. I had told myself going into this,