Name: Admin Registration
Description: Register as a user with administrator privileges.
Difficulty: 3 star
Category: Improper Input Validation
Expanded Description: https://pwning.owasp-juice.shop/part2/improper-input-validation.html
In the expanded description, it’s recommended that I try registering as an ordinary user to see what API endpoints are involved, then to “Think of the simplest possible implementations of a distinction between regular users and administrators”.
After setting up Burp Suite and FoxyProxy, then filling in the new user registration form, this is the packet that is sent to the server.
Fortunately, thanks to the user authentication details I gathered during the Admin Section challenge, I have a JSON document containing all of the database fields this form can populate.
Looking at the differences between the admin account and Jim’s account, it’s plain to see that the “role” field is the simplest way to differentiate between customer accounts and administrator accounts, so adding a “role” field to the outgoing registration packet identifying this user as an administrator may be sufficient to complete this challenge.
Prevention and mitigation strategies:
Lessons Learned and Things Worth Mentioning:
- This is a perfect example of using previously gathered information to help craft an entirely new attack. Having the user authentication details saved from the Admin Section challenge made completing this challenge far faster and simpler. This is why I always take time in challenges to gather any extra data I come across and save it in a specific directory for future reference. You never know when stuff will come in handy.