{"id":2746,"date":"2026-11-07T00:35:46","date_gmt":"2026-11-07T00:35:46","guid":{"rendered":"https:\/\/berenkudaygorun.com\/blog\/?p=2746"},"modified":"2026-11-07T00:35:48","modified_gmt":"2026-11-07T00:35:48","slug":"portswigger-business-logic-lab-7-weak-isolation-on-dual-use-endpoint","status":"publish","type":"post","link":"https:\/\/berenkudaygorun.com\/blog\/blog\/2026\/11\/07\/portswigger-business-logic-lab-7-weak-isolation-on-dual-use-endpoint\/","title":{"rendered":"PortSwigger Business Logic Lab 7: Weak Isolation on Dual-use Endpoint"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Bu labda, PortSwigger Web Security Academy\u2019nin Business Logic kategorisindeki \u201cWeak isolation on dual-use endpoint\u201d senaryosunu inceliyoruz. Parola de\u011fi\u015ftirme endpoint\u2019i, current-password parametresi istekten tamamen \u00e7\u0131kar\u0131ld\u0131\u011f\u0131nda mevcut parolay\u0131 do\u011frulamadan i\u015flemi ger\u00e7ekle\u015ftiriyor. Ayr\u0131ca parolas\u0131 de\u011fi\u015ftirilecek hesap, istekteki username parametresiyle belirleniyor. Amac\u0131m\u0131z, bu mant\u0131k hatas\u0131ndan yararlanarak administrator hesab\u0131n\u0131n parolas\u0131n\u0131 de\u011fi\u015ftirmek, bu hesapla giri\u015f yapmak ve carlos kullan\u0131c\u0131s\u0131n\u0131 silmek. <a href=\"https:\/\/portswigger.net\/web-security\/logic-flaws\/examples\/lab-logic-flaws-weak-isolation-on-dual-use-endpoint\">Lab ba\u011flant\u0131s\u0131<\/a>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Bizden admin olarak giri\u015f yapmam\u0131z\u0131 ve daha sonras\u0131nda carlos kullan\u0131c\u0131s\u0131n\u0131 silmemiz istiyor. Ve bize bir credential verilmi\u015f. Hesaba giri\u015f yapt\u0131\u011f\u0131mda beni bir parola ve e-posta g\u00fcncelleme sayfas\u0131 kar\u015f\u0131lad\u0131.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1100\" height=\"895\" src=\"https:\/\/berenkudaygorun.com\/blog\/wp-content\/uploads\/2026\/11\/image-82.jpeg\" alt=\"\" class=\"wp-image-2749\" srcset=\"https:\/\/berenkudaygorun.com\/blog\/wp-content\/uploads\/2026\/11\/image-82.jpeg 1100w, https:\/\/berenkudaygorun.com\/blog\/wp-content\/uploads\/2026\/11\/image-82-768x625.jpeg 768w\" sizes=\"auto, (max-width: 1100px) 100vw, 1100px\" \/><figcaption class=\"wp-element-caption\">Screenshot<\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Genel olarak testlerimi yapt\u0131m ve \u00e7ok basit bir \u015fey yakalad\u0131m. Normalde istek a\u015fa\u011f\u0131daki gibi ilerliyor.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1100\" height=\"827\" src=\"https:\/\/berenkudaygorun.com\/blog\/wp-content\/uploads\/2026\/11\/image-81.jpeg\" alt=\"\" class=\"wp-image-2748\" srcset=\"https:\/\/berenkudaygorun.com\/blog\/wp-content\/uploads\/2026\/11\/image-81.jpeg 1100w, https:\/\/berenkudaygorun.com\/blog\/wp-content\/uploads\/2026\/11\/image-81-768x577.jpeg 768w\" sizes=\"auto, (max-width: 1100px) 100vw, 1100px\" \/><figcaption class=\"wp-element-caption\">Screenshot<\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Ancak siz burada current password\u2019\u00fc \u00e7\u0131kart\u0131rsan\u0131z&#8230;<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1100\" height=\"827\" src=\"https:\/\/berenkudaygorun.com\/blog\/wp-content\/uploads\/2026\/11\/image-80.jpeg\" alt=\"\" class=\"wp-image-2747\" srcset=\"https:\/\/berenkudaygorun.com\/blog\/wp-content\/uploads\/2026\/11\/image-80.jpeg 1100w, https:\/\/berenkudaygorun.com\/blog\/wp-content\/uploads\/2026\/11\/image-80-768x577.jpeg 768w\" sizes=\"auto, (max-width: 1100px) 100vw, 1100px\" \/><figcaption class=\"wp-element-caption\">Screenshot<\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Admin ile giri\u015f yapt\u0131m, hedef kullan\u0131c\u0131y\u0131 sildim ve lab \u00e7\u00f6z\u00fclm\u00fc\u015f oldu.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Bu labda, PortSwigger Web Security Academy\u2019nin Business Logic kategorisindeki \u201cWeak isolation on dual-use endpoint\u201d senaryosunu inceliyoruz. Parola de\u011fi\u015ftirme endpoint\u2019i, current-password parametresi istekten tamamen \u00e7\u0131kar\u0131ld\u0131\u011f\u0131nda mevcut&#8230;<\/p>\n<div class=\"more-link-wrapper\"><a class=\"more-link\" href=\"https:\/\/berenkudaygorun.com\/blog\/blog\/2026\/11\/07\/portswigger-business-logic-lab-7-weak-isolation-on-dual-use-endpoint\/\">Devam\u0131n\u0131 oku<span class=\"screen-reader-text\">PortSwigger Business Logic Lab 7: Weak Isolation on Dual-use Endpoint<\/span><\/a><\/div>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[749],"tags":[753],"class_list":["post-2746","post","type-post","status-publish","format-standard","hentry","category-web","tag-business-logic","entry"],"_links":{"self":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/2746","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/comments?post=2746"}],"version-history":[{"count":1,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/2746\/revisions"}],"predecessor-version":[{"id":2750,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/2746\/revisions\/2750"}],"wp:attachment":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/media?parent=2746"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/categories?post=2746"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/tags?post=2746"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}