HackBlue

Labs / Web and API security

Request replay authorization diff

Replay each API request with a second user’s session and compare the responses line by line to find the endpoints that skip an ownership or role check.

  • Interactive lab
  • Beginner
  • 5 steps
  • 0 of 5 solved

Goal

You captured five API requests while signed in as Alice Moreno, an admin. Replay each one with the session of Bob Okafor, a regular member, and compare the two responses.

An identical response to an owner-only or admin-only request means the server never checked who was asking.

Captured as Alice

Alice · admin
GET /api/me HTTP/1.1
Host: api.contoso.example
Cookie: sess=al1ce-7f3a

HTTP/1.1 200 OK

{
  "id": "u-100",
  "name": "Alice Moreno",
  "role": "admin"
}
Bob · member
Not replayed yet.

Steps

  1. 01Which endpoint hands Alice’s private record to Bob?

  2. 02Bob can also run the admin user export. What is that class of bug called?

  3. 03GET /api/me returns different data for Bob. Is that a finding?

  4. 04How many of the five endpoints need a fix?

  5. 05What is the right fix for the invoice endpoint?