Beginner·150 points·31 solves
Ledgerly — Insecure Direct Object Reference
Learn Insecure Direct Object Reference (IDOR): when a page fetches a record by id but forgets to check you are allowed to see THAT record, you can read other people's data by changing the id.
Your invoice loads from a URL like /invoice?id=1002 . The server looks the invoice up by id and returns it — with no check that invoice 1002 belongs to you. So /invoice?id=1000 returns invoice 1000 just as happily, whether or not it is yours. The fix is an authorization check: confirm the logged-in user owns (or may view) the object before returning it.
Your tasks
1
Open the portal
You are signed in as Dana, with invoices #1002 and #1003. Open one and note the id in the URL.
2
Change the id
Edit the id in /invoice?id=… to a different number and load it. The app returns it with no ownership check.
3
Find the interesting account
Low ids often belong to the first/admin accounts. The CEO's invoice is #1000.
4
Read the CEO's invoice
Request /invoice?id=1000 — it isn't yours, but the app hands it over. The flag is in its note.
5
Capture the flag
Submit the master key from invoice #1000 in the panel.
Submit the flag
Start the lab, capture the flag from the running machine, and submit it here.