Advent Of Cyber 3 - Day 1

Posted on Dec 1, 2021
tl;dr: IDOR

using the “view site” , it’s possible to play around with the mockup browser/webpage.


here we quickly see that the “user_id” variable can be tampered with. After a quick enumeration where we try to go from 0 up to 11 (which is our own ID) we find that

user_id=1  is Santa , position: The Boss!
user_id=3 is McStocker , position: Build Manager
user_id=9 is Grinch , position: Mischief Manager 

reverting all the changes that the Grinch has made, reveals the flag: thm-aoc-day1


to play more with IDOR there’s a good [room]( on