2101 Web Security: Bypassing Authorization

side note: outdated tls version (accessing the main page with https and surpessing the warning)

• BCookie authorizes for all data

• login as any known user (registering a new user is possible as well, but the user has no profile page, as it does not get a pid (apperently), but that doesn't matter for the next steps, as we want the data of other users)
• BCookie is a session cookie
• ACookie has to be present for username not defaulting to null, but has no other meaning, as any value suffices to show the username (of the actual logged in user, not the username of the profile page shown)
• request http://glocken.hacking-lab.com/12001/cookie_case0/cookie0/controller?action=profile&pid=2 with any pid, to access the profiles of these users
• username is still the one one logged in with, but the data is the one of the user with the corresponding pid (see 2101_1.png and 2101_2.png)

• only allow access to the data of the user

• BCookie only allows access to data corresponding to it (see 2101_3.png)

• deleting ACookie results in error page, but still has no other meaning, as any value suffices (see 2101_4.png)