Apprentice
← all rooms
IDOR Low

Insecure Direct Object Reference

Enumerate account IDs and steal another user's details.

Mission briefing

NovaPay offers online banking with a settings page keyed by account number. Logged-in customers see their own profile, but the API takes a simple numeric id. Find out whether changing that id exposes someone else's account details.

0 / 1 tasks 0 / 10 pts

Objectives

  • Access the admin account via IDOR
Task 1 Account Enumeration Low 10 pts

Scenario

NovaPay shows account settings at a URL containing a numeric account id. You are logged in as a regular customer, but nothing stops you from changing that number. Find the administrator's account and read their private note.

Your approach

  1. Log in and open your own settings page; note the id in the path.
  2. Increment or decrement the id and reload to view other accounts.
  3. Look for an account with elevated privileges or a flag field.
  4. Copy the note or flag from the admin profile JSON or HTML.
  5. Submit that value as your task answer.

Open the NovaPay portal and follow the briefing steps. The admin account holds a private note with your flag.

Open lab →
Hint

The support lookup tool calls the same API as the settings page. Try ids above and below yours.