{"id":2627,"date":"2026-11-01T09:09:37","date_gmt":"2026-11-01T09:09:37","guid":{"rendered":"https:\/\/berenkudaygorun.com\/blog\/?p=2627"},"modified":"2026-11-01T09:09:39","modified_gmt":"2026-11-01T09:09:39","slug":"portswigger-access-control-lab-5-user-id-controlled-by-request-parameter","status":"publish","type":"post","link":"https:\/\/berenkudaygorun.com\/blog\/blog\/2026\/11\/01\/portswigger-access-control-lab-5-user-id-controlled-by-request-parameter\/","title":{"rendered":"PortSwigger Access Control Lab 5: User ID Controlled by Request Parameter"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Bu labda, PortSwigger Web Security Academy\u2019nin Access Control kategorisindeki \u201cUser ID controlled by request parameter\u201d senaryosunu inceliyoruz. Uygulaman\u0131n hesap sayfas\u0131nda, istekteki id parametresi de\u011fi\u015ftirilerek ba\u015fka bir kullan\u0131c\u0131n\u0131n hesap bilgilerine eri\u015filebiliyor. Bu yatay yetki y\u00fckseltme zafiyetinden yararlanarak amac\u0131m\u0131z, bize verilen hesapla giri\u015f yapt\u0131ktan sonra carlos kullan\u0131c\u0131s\u0131n\u0131n API anahtar\u0131n\u0131 elde etmek ve \u00e7\u00f6z\u00fcm olarak g\u00f6ndermek. <a href=\"https:\/\/portswigger.net\/web-security\/access-control\/lab-user-id-controlled-by-request-parameter\">Lab ba\u011flant\u0131s\u0131<\/a>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Yine son derece kolay bir lab. Amac\u0131m Burp lablar\u0131 i\u00e7in T\u00fcrk\u00e7e bir kaynak olu\u015fturmak ama bazen bu kolay lablar\u0131 \u00e7\u00f6zd\u00fckten sonra yazmak ger\u00e7ekten de\u011fer mi diye sorguluyorum&#8230;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Size verilen bir kullan\u0131c\u0131 ad\u0131, parola var. Bununla giri\u015f yap\u0131yorsunuz ve giri\u015f yapt\u0131ktan sonra ana sayfada o kullan\u0131c\u0131ya ait bir API key oluyor. Sizden istenilen asl\u0131nda ba\u015fka bir kullan\u0131c\u0131ya ait olan bir API key. Ben de bunun \u00fczerine istekleri inceledim. Normalde login olduktan sonra g\u00f6nderilen istek a\u015fa\u011f\u0131daki gibi:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>GET \/my-account?id=wiener HTTP\/2\nHost: 0a1200460309e09c803bd0bd00170022.web-security-academy.net\nCookie: session=GGF3CaZAK8JQQ56GWAv5DbKT18sadc0e\nCache-Control: max-age=0\nAccept-Language: tr-TR,tr;q=0.9\nUpgrade-Insecure-Requests: 1\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/156.0.0.0 Safari\/537.36\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/jxl,image\/avif,image\/webp,image\/apng,*\/*;q=0.8,application\/signed-exchange;v=b3;q=0.7\nSec-Fetch-Site: same-origin\nSec-Fetch-Mode: navigate\nSec-Fetch-User: ?1\nSec-Fetch-Dest: document\nSec-Ch-Ua: \"Not:A-Brand\";v=\"8\", \"Chromium\";v=\"156\"\nSec-Ch-Ua-Mobile: ?0\nSec-Ch-Ua-Platform: \"macOS\"\nReferer: https:\/\/0a1200460309e09c803bd0bd00170022.web-security-academy.net\/login\nAccept-Encoding: gzip, deflate, br\nPriority: u=0, i\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Buradaki iste\u011fi a\u015fa\u011f\u0131daki gibi manip\u00fcle ettim ve API key&#8217;i elde ettim.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1280\" height=\"1075\" src=\"https:\/\/berenkudaygorun.com\/blog\/wp-content\/uploads\/2026\/11\/image.jpeg\" alt=\"\" class=\"wp-image-2628\" srcset=\"https:\/\/berenkudaygorun.com\/blog\/wp-content\/uploads\/2026\/11\/image.jpeg 1280w, https:\/\/berenkudaygorun.com\/blog\/wp-content\/uploads\/2026\/11\/image-768x645.jpeg 768w\" sizes=\"auto, (max-width: 1280px) 100vw, 1280px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">API key&#8217;i sisteme verdi\u011finizde de lab \u00e7\u00f6z\u00fclm\u00fc\u015f oldu.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Bu labda, PortSwigger Web Security Academy\u2019nin Access Control kategorisindeki \u201cUser ID controlled by request parameter\u201d senaryosunu inceliyoruz. Uygulaman\u0131n hesap sayfas\u0131nda, istekteki id parametresi de\u011fi\u015ftirilerek ba\u015fka&#8230;<\/p>\n<div class=\"more-link-wrapper\"><a class=\"more-link\" href=\"https:\/\/berenkudaygorun.com\/blog\/blog\/2026\/11\/01\/portswigger-access-control-lab-5-user-id-controlled-by-request-parameter\/\">Devam\u0131n\u0131 oku<span class=\"screen-reader-text\">PortSwigger Access Control Lab 5: User ID Controlled by Request Parameter<\/span><\/a><\/div>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[749],"tags":[752],"class_list":["post-2627","post","type-post","status-publish","format-standard","hentry","category-web","tag-access-control","entry"],"_links":{"self":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/2627","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/comments?post=2627"}],"version-history":[{"count":1,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/2627\/revisions"}],"predecessor-version":[{"id":2629,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/2627\/revisions\/2629"}],"wp:attachment":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/media?parent=2627"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/categories?post=2627"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/tags?post=2627"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}