> For the complete documentation index, see [llms.txt](https://itrp19-notes.gitbook.io/notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://itrp19-notes.gitbook.io/notes/reference/hacking/port-swigger/access-control/user-role-controlled-by-request-parameter.md).

# User role controlled by request parameter

This lab has an admin panel at`/admin`, which identifies administrators using a forgeable cookie. Solve the lab by accessing the admin panel and using it to delete Carlos. You can log in to your own account using the following credentials:

On the lab's login page, enter the credentials that were provided to you.

Observe that the response sets the cookie Admin=false. Change it to Admin=true.

<figure><img src="/files/nwHdwJTiq2FbaUfSAPsF" alt=""><figcaption></figcaption></figure>

Admin panel shows up in Burp repeater

<figure><img src="/files/bniHc6lTPSKFKKqya07W" alt=""><figcaption></figcaption></figure>

Under "Application" in the Chromium browser, you will discover local cookies.

<figure><img src="/files/qme8isRTcyG58UUqrY0f" alt=""><figcaption></figcaption></figure>

Change Admin cookie to true to enable admin panel

<figure><img src="/files/oWt2ynV0aeG3qfycj2SN" alt=""><figcaption></figcaption></figure>

The flag

<figure><img src="/files/8ake0iMWOCGIfuBwpvEd" alt=""><figcaption></figcaption></figure>