# Horizontal PrivEsc

Horizontal PrivEsc refers to accessing directly the sensitive information of the other user, instead of using thier own resources.

```
For Example - If an employee is said to have his own payroll records or his own docs, but still he tries to access other employee's details then its a horizontal privesc.
```

This type of Privesc is similar to the Vertical one where the user tries to access the contents of another user by tampering the URL

```
https://example.com/myaccount=123
```

We get his API key !

```
An API key is a unique identifier used to authenticate a user, developer, or calling program to an API.
```

### User ID controlled by Request Parameter

In the given url, just tamper the username to `carlos` and it will retrieve an API key which is the flag.

### Request Parameter with Unpredictable user ID's

In some application, the exploitable parameter does not have a sequential value, an application might use `GLOBALLY UNIQUE IDENTIFIERS` to identify users.

It is tough for an attacker to guess the user's id so our only option is to check through the application throughly so that we find it in `user messages` or `reviews`.

> Crawl through the application and find another user's id and tamper it using our login's GET

### Request Parameter with Data Leakage in Redirect

Some application detects when the `user` is not permitted to access any `sensitive` resource, and then it redirects to the `Login` page.

It is mandatory to check the `response` containing the `redirect URL`, because it might still contain some sensitive information belonging to the targeted user, If this case comes true then the `attack` is `successful`.

> Check the response body of the redirect URL for some API Leaks
