# BlackVault Banking (CTF challenge)

> BlackVault is a private-banking portal with a full attack chain and TWO flags — treat it like a mini pentest, not a single bug.

Canonical: https://codelivly.com/ctf/challenges/blackvault-banking

| | |
|---|---|
| Category | Web Exploitation |
| Difficulty | Insane |
| Points | 5000 |
| Estimated time | 1 h 30 min |
| Type | Live instance |
| Solves | 9 |
| Author | Codelivly |

BlackVault is a private-banking portal with a full attack chain and TWO flags — treat it like a mini pentest, not a single bug. Start with recon, read what the frontend leaks, then chain a database flaw and a token weakness to reach the admin console. FLAG 1 (User) lives in the member API; FLAG 2 (System) lives behind the admin diagnostics. Your own isolated instance — flags are unique to you, so they can't be shared. Submit each flag in the box; capture both to complete the challenge.

## Related

- [All CTF challenges](https://codelivly.com/practice?type=ctf)