Let's look at a practical example using WebGoat:

1. Log in to WebGoat and go to Access Control Flaws | LAB Role Based Access Control | Stage 1: Bypass Business Layer Access Control:

3. Use Tomcat's credentials (Tom:tom) to log in and enable Firefox's Developer Tools (F12).
4. Let's inspect the list of employees. We can see that the only element, Tom Cat (employee), is an option HTML tag with the value 105:

4. Go to the Network tab in Developer Tools and click on ViewProfile. Notice how the request has a parameter called employee_id and its value is 105:

5. Click on ListStaff to go back to the list.
6. Change to the Inspector tab in Developer Tools.
7. Double-click on the value (105) of the option tag and change it to 101. We want to see whether it is possible to look at other users' information by changing this parameter.

8. Click on ViewProfile again:

9. Now, the task in WebGoat is to delete Tom's profile using his own account, so let's try that. Click on ListStaff to go back to the list.
10. Now, inspect the ViewProfile button.

11. Notice how its name is action and its value is ViewProfile; change the value to DeleteProfile:

12. The text in the button will change. Click DeleteProfile and this stage will be completed: