← back to room
IDOR
NovaPay — Account Settings
Scenario
NovaPay shows account settings at a URL containing a numeric account id. You are logged in as a regular customer, but nothing stops you from changing that number. Find the administrator's account and read their private note.
Your approach
- Log in and open your own settings page; note the id in the path.
- Increment or decrement the id and reload to view other accounts.
- Look for an account with elevated privileges or a flag field.
- Copy the note or flag from the admin profile JSON or HTML.
- Submit that value as your task answer.
NovaPay
Signed in as zoeyp5 · Internal id 1
Your profile
| Username | zoeyp5 |
|---|---|
| zoey.peltier10@fakemail.test | |
| Phone | 555 256 7446 |
Profile data is loaded from the account API. Open your record in the lookup tool below or inspect network requests while this page loads.
Account lookup (support console)
Fetch any account record by internal id — the same endpoint the settings page uses.
// JSON response appears here