Practice Log 02: Access Control Beyond a Hidden URL
I completed PortSwigger’s Unprotected admin functionality with unpredictable URL lab on October 25 as part of my PWPA preparation. This was familiar practice.
Using Burp Suite, I confirmed that I could reach administrative functionality and perform a restricted action. I completed the lab, but I’m leaving the discovery details and solution steps out of this entry.
Before working through the exercise, consider the permission boundary: should knowing the location of a resource be enough to use it?
An unpredictable URL can make functionality harder to find. It does not establish whether the person making a request has permission to use it. The server needs to enforce authorization even when the URL is known.
For regression testing, check that unauthorized requests are denied and that the prohibited change does not occur. Also verify that authorized use still works. These are checks to consider, not results I’m claiming from this lab session.
This journal makes room for practicing fundamentals while I deepen my application-security skills.
If you try the exercise, use PortSwigger’s authorized training environment and stay within its scope.