In this video, we cover Lab #5 in the Access Control Vulnerabilities module of the Web Security Academy. This website has an unauthenticated admin panel at /admin, but a front-end system has been configured to block external access to that path. However, the back-end application is built on a framework that supports the X-Original-URL header. To solve the lab, we access the admin panel and delete the user carlos. ▬ ✨ Support Me ✨ ▬▬▬▬▬▬▬▬▬▬ Buy my course: https://bit.ly/30LWAtE ▬ 📖 Contents of this video 📖 ▬▬▬▬▬▬▬▬▬▬ 00:00 - Introduction 00:13 - Web Security Academy Course (https://bit.ly/30LWAtE) 01:24 - Navigation to the exercise 02:04 - Understand the exercise and make notes about what is required to solve it 02:43 - Exploit the lab 16:20 - Summary 16:33 - Thank You ▬ 🔗 Links 🔗 ▬▬▬▬▬▬▬▬▬▬ Notes.txt document: https://github.com/rkhal101/Web-Security-Academy-Series/blob/main/broken-access-control/lab-05/notes.txt Python script: https://github.com/rkhal101/Web-Security-Academy-Series/blob/main/broken-access-control/lab-05/access-control-lab-05.py Web Security Academy Exercise Link: https://portswigger.net/web-security/access-control/lab-url-based-access-control-can-be-circumvented Rana's Twitter account: https://twitter.com/rana__khalil