{"id":2622,"date":"2026-10-31T12:57:46","date_gmt":"2026-10-31T12:57:46","guid":{"rendered":"https:\/\/berenkudaygorun.com\/blog\/?p=2622"},"modified":"2026-10-31T12:57:48","modified_gmt":"2026-10-31T12:57:48","slug":"portswigger-access-control-lab-4-user-role-can-be-modified-in-user-profile","status":"publish","type":"post","link":"https:\/\/berenkudaygorun.com\/blog\/blog\/2026\/10\/31\/portswigger-access-control-lab-4-user-role-can-be-modified-in-user-profile\/","title":{"rendered":"PortSwigger Access Control Lab 4: User Role Can Be Modified in User Profile"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Bu labda, PortSwigger Web Security Academy\u2019nin Access Control kategorisindeki \u201cUser role can be modified in user profile\u201d senaryosunu inceliyoruz. Uygulama, e-posta g\u00fcncelleme iste\u011finin JSON g\u00f6vdesine eklenen roleid parametresinin de\u011fi\u015ftirilmesine izin veriyor. Bu de\u011feri 2 yaparak y\u00f6netici yetkisi kazanmak ve \/admin adresindeki y\u00f6netim paneline eri\u015fmek m\u00fcmk\u00fcn oluyor. Amac\u0131m\u0131z, bize verilen hesapla giri\u015f yapt\u0131ktan sonra kullan\u0131c\u0131 rol\u00fcn\u00fc de\u011fi\u015ftirerek y\u00f6netim paneline eri\u015fmek ve carlos kullan\u0131c\u0131s\u0131n\u0131 silerek lab\u0131 \u00e7\u00f6zmek. <a href=\"https:\/\/portswigger.net\/web-security\/access-control\/lab-user-role-can-be-modified-in-user-profile\">Lab ba\u011flant\u0131s\u0131<\/a>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Bize bu labda roleid de\u011feri sadece 2 olan kullan\u0131c\u0131lar\u0131n admin paneline eri\u015fim sa\u011flayabilece\u011fini s\u00f6ylemi\u015f. Sisteme bana verilen kullan\u0131c\u0131 ile giri\u015f yapt\u0131m ve biraz inceledim. E-posta g\u00fcncelleme alan\u0131na bir istek att\u0131\u011f\u0131mda olu\u015fan istek ve cevap a\u015fa\u011f\u0131daki gibiydi.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1280\" height=\"1075\" src=\"https:\/\/berenkudaygorun.com\/blog\/wp-content\/uploads\/2026\/10\/image-66.jpeg\" alt=\"\" class=\"wp-image-2625\" srcset=\"https:\/\/berenkudaygorun.com\/blog\/wp-content\/uploads\/2026\/10\/image-66.jpeg 1280w, https:\/\/berenkudaygorun.com\/blog\/wp-content\/uploads\/2026\/10\/image-66-768x645.jpeg 768w\" sizes=\"auto, (max-width: 1280px) 100vw, 1280px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Bunun \u00fczerine burada roleid de\u011ferini de de\u011fi\u015ftirecek \u015fekilde iste\u011fi manip\u00fcle ettim. Olu\u015fan istek a\u015fa\u011f\u0131daki gibi oldu ve cevap da istedi\u011fimiz gibi geldi.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1280\" height=\"1075\" src=\"https:\/\/berenkudaygorun.com\/blog\/wp-content\/uploads\/2026\/10\/image-65.jpeg\" alt=\"\" class=\"wp-image-2624\" srcset=\"https:\/\/berenkudaygorun.com\/blog\/wp-content\/uploads\/2026\/10\/image-65.jpeg 1280w, https:\/\/berenkudaygorun.com\/blog\/wp-content\/uploads\/2026\/10\/image-65-768x645.jpeg 768w\" sizes=\"auto, (max-width: 1280px) 100vw, 1280px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Sayfay\u0131 yeniledi\u011fimde art\u0131k admin&#8217;dim ve hedef kullan\u0131c\u0131y\u0131 silmeyi ba\u015fard\u0131m.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1280\" height=\"1075\" src=\"https:\/\/berenkudaygorun.com\/blog\/wp-content\/uploads\/2026\/10\/image-64.jpeg\" alt=\"\" class=\"wp-image-2623\" srcset=\"https:\/\/berenkudaygorun.com\/blog\/wp-content\/uploads\/2026\/10\/image-64.jpeg 1280w, https:\/\/berenkudaygorun.com\/blog\/wp-content\/uploads\/2026\/10\/image-64-768x645.jpeg 768w\" sizes=\"auto, (max-width: 1280px) 100vw, 1280px\" \/><\/figure>\n","protected":false},"excerpt":{"rendered":"<p>Bu labda, PortSwigger Web Security Academy\u2019nin Access Control kategorisindeki \u201cUser role can be modified in user profile\u201d senaryosunu inceliyoruz. Uygulama, e-posta g\u00fcncelleme iste\u011finin JSON g\u00f6vdesine&#8230;<\/p>\n<div class=\"more-link-wrapper\"><a class=\"more-link\" href=\"https:\/\/berenkudaygorun.com\/blog\/blog\/2026\/10\/31\/portswigger-access-control-lab-4-user-role-can-be-modified-in-user-profile\/\">Devam\u0131n\u0131 oku<span class=\"screen-reader-text\">PortSwigger Access Control Lab 4: User Role Can Be Modified in User Profile<\/span><\/a><\/div>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[749],"tags":[752],"class_list":["post-2622","post","type-post","status-publish","format-standard","hentry","category-web","tag-access-control","entry"],"_links":{"self":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/2622","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/comments?post=2622"}],"version-history":[{"count":1,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/2622\/revisions"}],"predecessor-version":[{"id":2626,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/2622\/revisions\/2626"}],"wp:attachment":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/media?parent=2622"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/categories?post=2622"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/tags?post=2622"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}