👤 Account Profile & Identity Attributes
Manage your CloudShield organization profile. Changes are serialized and dispatched via background REST API calls to POST /api/user/profile/update.
🎯 Lab Objective:
You are authenticated as standard user Carlos Rivera (ID #102). Use Burp Suite or Browser DevTools (Network tab) to intercept the profile update API request. Exploit Mass Assignment and IDOR to elevate your account to
"role": "admin" (or overwrite Admin Sarah's profile #101), then access the Executive Security Console to capture the flag.
Current Account State
Carlos Rivera
carlos@cloudshield.io (ID #102)
ROLE: USER
VIP PRIVILEGED: NO
👥 Organization Directory (Audit List)
Public enterprise roster visible to all internal personnel.
| User ID | Username | Full Name | Corporate Email | Assigned Role |
|---|---|---|---|---|
#101 |
sarah.admin | Sarah Jenkins | sarah.admin@cloudshield.io | ADMIN |
#102 |
carlos | Carlos Rivera | carlos@cloudshield.io | USER |