Developer Solves PortSwigger Access Control Lab After Six Hours by Swapping Session Cookie

·1 views

A developer spent six hours attempting to escalate a non-admin user account to admin privileges in a PortSwigger web security lab focused on multi-step access control vulnerabilities. The lab required completing a two-step admin upgrade flow without having legitimate admin access. After exhausting numerous approaches — including testing HTTP methods, referrer headers, and URL parameters — the solution came from intercepting every request in the full admin flow and comparing them side by side. The key difference was not in the headers as initially suspected, but in the session cookie: the developer swapped the admin session cookie in the final confirmation request with their own non-admin session cookie, triggering a successful 302 redirect. Throughout the process, the developer deliberately avoided using AI tools, choosing instead to work through the problem manually in order to build a deeper understanding of access control weaknesses.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

OWASP Top 10: A Complete Guide to the Most Critical Web App Vulnerabilities

The OWASP Top 10 is a periodically updated consensus document published by the Open Web Application Security Project, a nonprofit focused on improving software security. It identifies the ten most critical security risks facing web applications, serving as a key reference for developers, security engineers, and IT professionals. The most recent edition, released in 2021, introduced new vulnerability categories and restructured existing priorities to reflect the evolving threat landscape. Among the top risks are Broken Access Control, where users can exceed their intended permissions, and Cryptographic Failures, which involve weak encryption or transmission of sensitive data in plaintext. The guide pairs each vulnerability with practical code examples and recommended countermeasures to help organizations prevent and mitigate common attacks.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Expense Receipt PDF Fraud Costs Firms $40,000 Per Scheme as Controls Miss the File

The Association of Certified Fraud Examiners estimates expense reimbursement fraud causes a median loss of $40,000 per scheme, typically going undetected for around two years. Standard financial controls such as three-way matching and policy checks validate data extracted from receipts but never inspect the actual uploaded PDF file itself. Employee-submitted travel and entertainment receipts are especially vulnerable because they are self-submitted, individually small, and usually fall below the approval or sampling thresholds that would trigger closer review. A fraudster can quietly alter a hotel folio — raising a room rate from $189 to $312, for example — and the edited file is unlikely to be caught through visual spot-checks alone. This structural blind spot in expense reimbursement workflows means repeated small edits across many claims can accumulate into significant losses before any alarm is raised.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How Proxy Rotation Strategies Help Developers Avoid IP Bans at Scale

Proxy rotation — cycling through multiple IP addresses to distribute traffic — has become a critical practice for developers and businesses running web scraping, API testing, or market research at scale. Without rotation, a single IP can quickly get rate-limited or permanently banned by anti-scraping systems that flag unusual request patterns. Experts recommend pairing rotation with randomized delays of 2–10 seconds between requests to mimic normal user behavior and reduce detection risk. Different rotation strategies suit different workloads: per-request rotation works best for heavy scraping, session-based rotation balances safety and efficiency, and adaptive rotation responds dynamically to error codes like HTTP 429 or 403. The choice of proxy type and pool size also matters, with larger IP pools and smarter throttling significantly improving long-term success rates.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How DJI's Drone Tech Spawned Zhuoyu, China's Low-Cost Autonomous Driving Startup

Zhuoyu Autonomous Driving originated in 2016 as an internal DJI research project led by engineer Shen Shaojie, who had pioneered stereo-camera systems for drones at HKUST. The team recognized that machine vision for drones and environmental perception for vehicles shared the same underlying logic, prompting a pivot toward automotive applications. By 2018, the project had secured one of Shenzhen's first autonomous driving test permits and was conducting open-road trials using perception technology adapted from drone systems. Formally established as DJI's Automotive division in 2021, the company pursued a contrarian approach — relying on a seven-camera vision setup, no lidar, no HD maps, and as little as 32 TOPS of compute — to bring city-level driving assistance to EVs priced under RMB 100,000. Its Chengxing Platform debuted in the 2022 Baojun KiWi EV, drawing industry attention for delivering advanced driver assistance at an unprecedented price point.

0 comments Read more at DEV Community