A web application challenge highlighting an Insecure Direct Object Reference (IDOR) flaw. It demonstrates how manipulating a numeric identifier in an API endpoint (/api/stats/:id) bypasses missing backend authorization checks to leak other users' sensitive study statistics and capture the flag..
The Ottergram challenge on BugForge is an easy-level web vulnerability lab centered on exploiting a misconfigured GraphQL endpoint. Players must leverage enabled introspection to map the database schema, identify poor object-level access controls, and perform an IDOR attack by manipulating user identifiers to access administrative accounts and recover a hidden flag.
An easy-level web vulnerability challenge focused on JWT privilege escalation. It demonstrates how improper signature validation and insecure client-side token management allow users to manipulate roles and IDs to bypass access controls, reach the admin panel, and retrieve the flag.