# CopyPasta

> Today we have a ***Broken Access Control*** vulnerability today.

Today I had to click around a bit more to find a vulnerable point in the application. I had not tested all the functionality before I went to BurpSuite, so that's why it took me a bit longer than usual.

{% hint style="info" %}
Make sure to test all functionality. If you find nothing, start at the beginning and make sure to click all the buttons and highlight them in Burp at the same time so you don't overlook anything.
{% endhint %}

Finally I found an endpoint where a userId was sent with the PUT request on `api/profile/password` , normally the flag is at the admin, and *usually*, the id is 2, but today I had to find out not to assume things 😅.

So I updated the password for userId 1.

<figure><img src="https://2622029278-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FV7OebgUO4GDe408WfphF%2Fuploads%2FosoQLAIzYnC9gcYH6k2b%2Fafbeelding.png?alt=media&#x26;token=b79d7b72-00be-42e4-a39a-d9ccb5fc8ffd" alt=""><figcaption></figcaption></figure>

I logged in as admin, with the new password and looked at the private snippets.

<figure><img src="https://2622029278-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FV7OebgUO4GDe408WfphF%2Fuploads%2FEQKUM08Q0zt8sIPfL7By%2Fafbeelding.png?alt=media&#x26;token=b3fe9307-6637-4acc-9688-79d5ee734564" alt=""><figcaption></figcaption></figure>

And there, I found my flag 🇧🇪
