BBLABS v2BBLABSv2
>Home>Labs
>New labs

Latest 3 labs

Loading…

View all labs →
>Creators>Ranking
>Learn

Learn bug bounty

AcademyGuides, cheatsheets and glossaryVulnerabilitiesXSS, SQLi, IDOR, SSRF and moreHacker RoadmapYour step-by-step bug bounty pathBlogBug bounty guides and news
>Business>Pricing
ES
Log inLog in
>Home>Labs>New labs>Creators>Ranking>Learn>Business>Pricing
ES
Sign inCreate account
  1. Home
  2. Labs
  3. Client-Side Role Bypass + Missing Server RBAC
MediumVDP35 min

Client-Side Role Bypass + Missing Server RBAC

By @gorka

Plataforma de ranking de hackers donde el rol del usuario se controla desde el cliente. Modificando la respuesta del servidor con Burp Suite (Match & Replace) se puede escalar a admin y cambiar la contrasena del super-hacker

440 views22 completedUpdated Sep 2026
Log in to start

Learn to find this bug

A real HackerOne hack, reproduced for you to practice.

Create your account and practice real bugs that got paid. Download the environment, find it and learn the exact technique — your path to your first bounty.

650

hunters training

50

labs from real hacks

380

completions

$12,000

paid out for these bugs

40 flags captured this week
Create account
I already have an account

Access to all labs · no commitment · cancel anytime

Hackers who solved it· 8

zynap1
@zynapAug 2026
benjaminnocervigni2
@benjaminnocervigniAug 2026
VA3
@vazquezdv182005Aug 2026
kaneki
@kanekiJul 2026
flyingwhales
@flyingwhalesJul 2026
r4mattra
@r4mattraJul 2026
AL
@alex.burja.2000Jul 2026
0xyo
@0xyoJul 2026

Objectives

1
Registrarse y observar que la respuesta contiene role: user
2
Usar Burp Match & Replace para cambiar role: user por role: admin en las respuestas
3
Acceder al panel de administracion que ahora aparece en la interfaz
4
Descubrir que los endpoints de admin no validan el rol en el servidor
5
Cambiar la contrasena del usuario thebesthacker para obtener la flag

Information

Platform
HackerOne
Difficulty
Medium
Duration
35 min
Bounty
VDP
Completed
22
Creator
gorka@gorka
Updated
Sep 2026

Download the environment

Reproduce it and find the bug yourself

Create account

Tools

Burp SuiteNavegador

Prerequisites

  • Uso basico de Burp Suite (Match & Replace)
  • Entender la diferencia entre validacion client-side y server-side

Tags

Business Logic

Achievement you'll earn

Solve this lab to unlock this shareable achievement

BBLABS.ESLab Solved
MediumVDP
// achievement_unlocked

Client-Side Role Bypass + Missing Server RBAC

Business Logic
Sep 2026
gorka
solved_by@gorkaMember since Mar 2026
bblabs.es// real hacking practice

Community writeups

Despliegue

# Opcion 1: autodeploy
./autodeploy.sh

# Opcion 2: manual
docker compose up --build

# Acceder
http://localhost:1700

Compatible con macOS, Linux y Windows (Docker Desktop / WSL).

Para parar:

./autodeploy.sh destroy
# o: docker compose down -v

Contenido del Lab

La aplicacion

CyberRank es una plataforma de ranking de hackers con leaderboard, panel de administracion y un super-hacker panel secreto.

La vulnerabilidad

El servidor envia role: user en las respuestas de autenticacion y el frontend muestra/oculta secciones basandose en ese valor. Sin embargo, los endpoints de admin (/api/admin/*) no verifican el rol del usuario en el servidor, confiando unicamente en el cliente.

Cadena de ataque

1. Registrarse → role: user
2. Burp → Match & Replace: role.*user → role.*admin
3. Refrescar → Panel admin visible
4. GET /api/admin/users → Lista usuarios (funciona sin ser admin!)
5. Cambiar contrasena de thebesthacker
6. Login como thebesthacker → Flag

Solucion interactiva

Accede a /writeup dentro de la aplicacion para una guia paso a paso con botones interactivos.

Remediacion

  1. Validar roles en el SERVIDOR, nunca confiar en el cliente
  2. Implementar middleware de autorizacion en cada endpoint admin
  3. No exponer el rol en las respuestas del API si no es necesario
  4. Principio de menor privilegio en cada endpoint

Contact

Practice, learn and hack

Bug bounty practice platform with labs based on real hacks. Learn ethical hacking in safe environments.

contact→

Follow us

YouTube
@0xGorka
X
@gorkaelbochi
LinkedIn
gorka-el-bochi-morillo
Instagram
@_.gorkaaa.b
Email
team@bblabs.es

Access every lab from €7.99/mo

New labs every week. Cancel anytime.

Create account

BBLabs is the bug bounty labs platform where you learn bug bounty with real vulnerabilities extracted from paid hacks on HackerOne, YesWeHack and Bugcrowd. Here you practice web hacking —XSS, SQLi, IDOR, SSRF, CSRF and more— in downloadable environments, capture the flag, read the writeup and apply the technique on active bug bounty programs.

BBLabs is the alternative to HackTheBox, TryHackMe and PentesterLab for those who want to practice bug bounty with real hacks instead of artificial CTFs. From €7.99/mo, no commitment.

→ Learn bug bounty from scratch→ How to do bug bounty step by step→ Real bug bounty reports→ BBLabs for companies and academiesLabsAcademyVulnerabilitiesToolsHacker rankingXSS labsIDOR labsSSRF labsCSRF labsHackTheBox alternativeHack4u alternativeTryHackMe alternativePortSwigger alternativePentesterLab alternativeBug Bounty Labs comparisonHackerOne to practiceOffSec / OSCP alternativeINE / eWPT alternativeHTB Academy alternativeDVWA alternativeJuice Shop alternativeVulnHub alternativePentesterAcademy alternativeRoot-Me alternativeHackTheBox vs TryHackMeBest bug bounty platforms 2026BlogSpoilersWhat is bug bounty?How much do you earn in bug bounty?OWASP Top 10 explainedBest sites to practice web hackingHow to become an ethical hacker from scratchBurp Suite tutorial (Spanish)OSCP guide and prepGoogle Dorks for bug bountyHow much an ethical hacker earns in SpainBug bounty tools 2026Best cybersecurity certifications 2026Burp Suite tutorialsqlmap tutorialffuf web fuzzingnuclei tutorialHTTP Request SmugglingWAF bypassPrompt injection (LLM)Google Dorks
Made withand code
TermsPrivacyCookiesComparisonES

© 2026 BBLABS v2 — All rights reserved