A web application challenge highlighting an Insecure Direct Object Reference (IDOR) flaw. It demonstrates how manipulating a numeric identifier in an API endpoint (/api/stats/:id) bypasses missing backend authorization checks to leak other users' sensitive study statistics and capture the flag..
The Ottergram challenge on BugForge is an easy-level web vulnerability lab centered on exploiting a misconfigured GraphQL endpoint. Players must leverage enabled introspection to map the database schema, identify poor object-level access controls, and perform an IDOR attack by manipulating user identifiers to access administrative accounts and recover a hidden flag.
An easy-level web vulnerability challenge focused on JWT privilege escalation. It demonstrates how improper signature validation and insecure client-side token management allow users to manipulate roles and IDs to bypass access controls, reach the admin panel, and retrieve the flag.
Two CSRF vulnerabilities on a car marketplace — one allowed modifying other users' listings (CSRF + IDOR), the other silently added cars to a victim's saved list.
A state-changing API endpoint in a web application editor had no CSRF protection at all, allowing attackers to silently inject data into victim accounts via a simple HTML form.
A collection of writeups for the N7 CTF, covering Web, Cryptography, Steganography, and Reverse Engineering challenges.