Minor Bugfixes
git-svn-id: http://webgoat.googlecode.com/svn/trunk/webgoat@338 4033779f-a91e-0410-96ef-6bf7bf53c507
This commit is contained in:
@ -35,9 +35,9 @@ deletes employees. Of course you could just guess
|
||||
it because it has a really logical name.
|
||||
But we will look it up. So your first step is to log in as John with john as
|
||||
password. Use WebScarab to intercept the delete request.
|
||||
<center>
|
||||
|
||||
<img src="/WebGoat/lesson_solutions/Lab Access Control/images/access_control_stage1.png" width=450px alt="deleteAction" />
|
||||
</center>
|
||||
|
||||
As you can see the delete action is called DeleteProfile.
|
||||
Now log in as Tom. Click in the list on his name and make sure WebScarab
|
||||
will intercept the next request. Click on a button, for example the
|
||||
|
@ -37,10 +37,10 @@ of another employee!
|
||||
</p>
|
||||
<p>
|
||||
Log in as Tom with tom as password. Click on Tom's name in the list and make sure
|
||||
webscarab will intercept the next request. Change the employee_id for example to 101.
|
||||
<center>
|
||||
webscarab will intercept the next request. Change the employee_id for example to 101.<br><br>
|
||||
|
||||
<img src="/WebGoat/lesson_solutions/Lab Access Control/images/access_control_stage1.png" width=450px alt="deleteAction" />
|
||||
</center>
|
||||
|
||||
|
||||
</body>
|
||||
</html>
|
Reference in New Issue
Block a user