## Apprentice Level - ✅ [[1. Unprotected admin functionality]] - ✅ [[2. Unprotected admin functionality with unpredictable URL]] - ✅ [[3. User role controlled by request parameter]] - ✅ [[4. User role can be modified in user profile]] - ✅ [[5. User ID controlled by request parameter]] - ✅ [[6. User ID controlled by request parameter, with unpredictable user IDs]] - ✅ [[7. User ID controlled by request parameter with data leakage in redirect]] - ✅ [[8. User ID controlled by request parameter with password disclosure]] - ✅ [[9. Insecure direct object references]] ## Practitioner Level - ✅ [[10. URL-based access control can be circumvented]] - ✅ [[11. Method-based access control can be circumvented]] - ✅ [[12. Multi-step process with no access control on one step]] - ✅ [[13. Referer-based access control]]