Beginner·100 points·44 solves
Gridline — Broken Access Control
Learn broken access control (missing function-level authorization): when a privileged page relies on simply not being linked rather than on an auth check, anyone who finds the URL can use it.
Gridline hides its admin console by never linking to it — "security through obscurity". But the server never checks whether the requester is an administrator; it serves any /admin/ path to anyone. This is different from IDOR: there is no object id to change, the whole admin FUNCTION is unprotected. Attackers find such pages by guessing common paths (/admin, /dashboard) and by reading recon sources like robots.txt, which often lists the very paths a site wants hidden. The fix is a server-side authorization check on every privileged route — never rely on a link being absent.
Your tasks
1
Look around as a guest
Open the lab. You are a read-only guest and the admin console is not linked anywhere in the UI.
2
Check recon sources
Sites often disclose hidden paths in robots.txt. Read /robots.txt and note what it tries to keep crawlers away from.
3
Visit the hidden area directly
The path robots.txt disallows is not actually protected — request it in the browser.
4
Read the admin dashboard
The admin console serves anyone. The master operations key is on it.
5
Capture the flag
Submit the master operations key in the panel.
Submit the flag
Start the lab, capture the flag from the running machine, and submit it here.