missing-function-access-control.title=Missing Function Level Access Control

access-control.hidden-menus.success=Correct! And not hard to find are they?!? One of these urls will be helpful in the next lab.
access-control.hidden-menus.close=Close. Remember that when hacking ... details such as order,case and the like matter.
access-control.hidden-menus.failure=Please try again.

access-control.hidden-menus.hint1=You can inspect the DOM or review the source in the proxy request/response cycle.
access-control.hidden-menus.hint2=Look for indications of something that would not be available to a typical user
access-control.hidden-menus.hint3=Look for something a super-user or administator might have available to them

access-control.hash.success=Congrats! You really succeeded when you added the user.
access-control.hash.close=Keep trying, this one may take several attempts & steps to achieve. See the hints for help.

access-control.hash.hint1=This assignment involves one simple change in a GET request.
access-control.hash.hint2=If you haven't found the hidden menus from the earlier exercise, go do that first.
access-control.hash.hint3=When you look at the users page, there is a hint that more info is viewable by a given role.
access-control.hash.hint4=Have you tried tampering the GET request? Different content-types?
access-control.hash.hint5=Modify the GET request to '/access-control/users' to include 'Content-Type': 'application/json'

access-control.hash.hint6=Now for the harder way ... it builds on the easier way
access-control.hash.hint7=If the request to view users, were a 'service' or 'RESTful' endpoint, what would be different about it?
access-control.hash.hint8=If you're still looking for hints ... try changing the Content-type header as in the GET request.
access-control.hash.hint9=Assuming the administrators have fixed the user management as a RESTful endpoint, what alternative approaches, apart from the type of request discussed in the previous lesson, could you explore?
access-control.hash.hint10=To determine the correct payload for the request, it's essential to examine how the registration process operates. Ensure that the payload is properly formatted according to the content type you defined earlier. Additionally, consider what information the response reveals when you submit an empty payload using the previously identified content type.
access-control.hash.hint11=You will want to add your own username with an admin role. Yes, you'd have to guess/fuzz this in a real-world setting.
access-control.hash.hint12=Alright, let's proceed. To grant admin privileges to our current WebGoat user, change the method to POST and set the content-type to 'application/json'. Your payload should resemble something like this: {"username":"your-webgoat-user", "password":"", "admin": "true"}. Ensure that you are adding admin privileges to our current WebGoat user.
access-control.hash.hint13=Once you've escalated yourself to an admin, retry the GET request to '/access-control/users-admin-fix'.
