# Bank Heist (CTF challenge)

> NimbusBank's API has four flaws that chain into a full heist. You're logged in as customer 1001. Read where you shouldn't (IDOR), move money you don't own (business logic), promote yourself (mass…

Canonical: https://codelivly.com/ctf/challenges/bank-heist

| | |
|---|---|
| Category | Web Exploitation |
| Difficulty | Insane |
| Points | 8000 |
| Estimated time | 2 h |
| Type | Live instance |
| Solves | 10 |
| Author | Codelivly |

NimbusBank's API has four flaws that chain into a full heist. You're logged in as customer 1001. Read where you shouldn't (IDOR), move money you don't own (business logic), promote yourself (mass assignment), then crack the vault — four tokens, one per stage. Your own isolated instance; the tokens are unique to you. Submit each CLV{...}; capture all four to complete.

## Related

- [All CTF challenges](https://codelivly.com/practice?type=ctf)