Assignment 1:
Hackxpert.com/pentest
- Log in with the user admin/test
- Create a new user who can not do anything (all unchecked) 
- Copy the URL to create a new user
- Log in as the low priv user
- Paste the URL in the browser again 

What is happening? 

Assignment 2:
Now do the same but in burp suite, replace the auth header of the admin with the one from the low priv user. Make sure you are still seeing the correct response. 

What auth header did you have to replace and why? 

Assignment 3: 
Now do the same with burp suite’s extension authorize
Paste the low priv user’s auth header’s in the box and explore the website as the admin

Why as the admin exploration?
Can’t get a result in authorise? Replace ONLY the auth cookie. 

Assignment 4:
Now find all the BAC issues in this website
Which ones are there?

Assignment 5:
Now we move over to ratsite, find ALL the BAC issues

Assignment 6: 
We are adding IDOR into the mix. Try to create a private contact. Try to edit it with another user.