CWAP Module 02 practice pack. Every mini-lab below is an isolated, intentionally-insecure access-control target. Naked labs have one clean finding each; the methodology lab hides its finding among decoys and asks you to hunt. Nothing emits a flag - your progress is a checklist of the controls you have broken this session.
Naked mini-labs
NAKEDIDOR (numeric) A numeric object id with no ownership check - read another user's order.
NAKEDBFLA / forced browse An admin-only function reachable by forced browsing, with no role check.
NAKEDMass assignment A profile update binds the whole body - set a privileged field and escalate.
NAKEDMethod tampering Reads are authorized, but the destructive verb on the same object is not.
NAKEDParameter-trust The server decides your privilege from a role it receives from the client.
NAKEDPath / gateway bypass A gate blocks the admin path - a path variant slips straight past it.
Methodology mini-labs
METHODOLOGYMulti-tenant portal A small multi-tenant SaaS. You are a low-priv member of one tenant. Harvest object ids from a search response, pivot via IDOR into another tenant's data, then reach that tenant's admin action which only checks a client-supplied role. Some endpoints ARE properly protected - find the one that is not.