Apprentice
← all rooms
Broken Access Control Medium

Broken Access Control

A mini course platform with hidden APIs, privilege escalation, IDOR, and a payment bypass.

Mission briefing

LearnHub is a course platform where students buy lessons and admins manage content. The SPA calls several JSON APIs and trusts some client-side state about payment. Map the surface as a normal student and see where role checks fall short.

0 / 3 tasks 0 / 30 pts

Objectives

  • Hit hidden admin APIs as a normal user
  • Escalate your role to admin
  • Bypass the client-side paid check
Task 1 Hidden Admin API Medium 10 pts

Scenario

LearnHub exposes JSON admin endpoints alongside student routes. You are logged in as an ordinary student with no elevated role. Discover and call hidden admin APIs to retrieve a sensitive key.

Your approach

  1. Log in as the demo student and browse dashboard network traffic.
  2. Fuzz or guess paths under the api admin namespace.
  3. Request admin keys or settings without an admin session.
  4. Copy the admin API key flag from the JSON response.
  5. Submit that flag.

Log in as user1/user123. Discover admin API paths and call them.

Open lab →
Hint

Also try /labs/bac/api/admin/settings and /labs/bac/api/admin/users/all

Task 2 Privilege Escalation Medium 10 pts

Scenario

The student dashboard includes a form that updates your role label. The server applies whatever role value you POST without verifying eligibility. Promote yourself to admin and open the admin panel.

Your approach

  1. Locate the role update form or endpoint on the dashboard.
  2. POST role set to admin while authenticated as a student.
  3. Navigate to admin-only pages now visible in the UI.
  4. Read secret_flag from admin settings.
  5. Submit the admin panel flag.

Use the role update form on the dashboard to become admin.

Open lab →
Hint

POST /labs/bac/update_role with role=admin

Task 3 Payment Bypass Medium 10 pts

Scenario

Paid course videos unlock only when an API reports paid status true. The front end trusts that JSON field from a user-specific endpoint. Watch premium content without completing checkout.

Your approach

  1. Open a locked course page and inspect paid-status API calls.
  2. Intercept the response and change paid from false to true.
  3. Reload the course page with the modified client state or repeat with a proxy.
  4. Confirm videos unlock and the lab shows a bypass flag.
  5. Submit the payment bypass flag.

The course page trusts paid status from the API response.

Open lab →
Hint

Intercept /labs/bac/api/user/paid-status and change paid to true.