> For the complete documentation index, see [llms.txt](https://dev-angelist.gitbook.io/writeups-and-walkthroughs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://dev-angelist.gitbook.io/writeups-and-walkthroughs/portswigger-web-security-academy/deserialization-insecure/java-insecure-deserialization/lab.md).
# Lab
https\://portswigger.net/web-security/api-testing/lab-exploiting-api-endpoint-using-documentation
## Description
## Solution
Go to login page and access as wiener user.
JWT extension reveal that there's a JWT token, obviously related to wiener user account
```json
{"iss":"portswigger","exp":1742668339,"sub":"wiener"}
```
Send it to repeater and select JSON web Token tab to deep dive to it
Modify the sub field inserting: "administrator" (if the key field isn't compiled, is necessary to add it clicking to Sign button)
and click first on the **Send** button and then on **Following redirection** button
authenticating us as administrator
Checking the response the admin panel's path is: `/admin`
so we can move there via a GET request: `GET /admin HTTP/2`
analyzing the response, we see that the request to delete the user Carlos is the following: `GET /admin/delete?username=carlos HTTP/2`
So, Send and click to Following redirection to delete it and complete the lab.
