Demo 3 — Cookie tampering: this page decides who you are from a cookie called role. Right now yours says guest. In Burp (or the browser's dev-tools → Application → Cookies), change it to admin and reload. The site believed you — because it trusted a value you control.