02 Lab: Host header authentication bypass

Objetivo

This lab makes an assumption about the privilege level of the user based on the HTTP Host header.

To solve the lab, access the admin panel and delete the user carlos.

Solución

https://0a3900d804b29449821397ea001500d4.web-security-academy.net/robots.txt

Aqui podemos visualizar que el directorio /admin está oculto

Admin interface only available to local users

Este error nos indica que podriamos acceder utilizando el localhost como parámetro

A partir de aqui, nuestras consultas deben tener el parametro host con el valor de localhost