WEB-02 · Web Security

Guest Access

A simulated dashboard decides what you may see from a value it stored in your own browser.

Portal Dashboard

signed in as guest

role: guest

Your stuff

Welcome back. Guests can see this page, but the admin panel below is locked.

Admin panel

Locked. This area is for administrators only. The app decides what you may see from a value it stored in your browser when you signed in.

How to solve

Open DevTools (F12) → Application (Chrome) or Storage (Firefox) → Local Storage for this page.
Find the key cys401-lab-web02-role with value guest.
Change its value to admin, then click Reload dashboard.
The admin panel opens and reveals the flag.

Lab details

Category: Web Security
Flaw: Broken access control
Difficulty: Easy
Tool: Storage inspector

This is a self-contained simulation for learning. The “server”, “database”, and “query” are all mocked in this page’s JavaScript. Nothing here connects to a real system.