Initial Reconnaissance

Before signing up, examine the login page source code for any developer comments or hidden information. While this challenge did not reveal anything in the source, always check for horizontal scrolling as CTFs sometimes hide clues off-screen.

Attempt basic SQL injection on the login form using payloads such as admin' OR 1=1;-- -. The application returns a generic “Invalid credentials” message, indicating that username enumeration via error messages is not possible.

Account Registration and Traffic Analysis

Register a new user account while capturing traffic in Caido. The goal is to determine whether the client is sending role or permission fields to the backend during registration, and whether the endpoint is vulnerable to Mass Assignment.

Application Mapping

After logging in, explore the application functionality:

• Account Management : Update Account and attempt account deletion
• My Snippets / Dashboard: Create and manage personal code snippets
• Public: View publicly shared snippets from all users with search and language filter options
• Create Snippet: Form with title, language, code content, and visibility toggle (public/private)

Create a test snippet and observe the response. Note the id field (sequential integer) and share_code field (long token string) returned in the response.

Identifying the IDOR Vector

When viewing a public snippet, observe that the URL follows the pattern /snippet/:id and the API endpoint is /api/snippets/:id.

Key observations:

• The public dashboard shows 6 snippets
• When creating your own snippet, the returned id value suggests there are more snippets than publicly visible (e.g., id of 8 indicates snippets 1-7 already exist)
• This discrepancy suggests some snippets are private and potentially accessible via direct ID reference

Exploiting the IDOR Vulnerability

Send the GET request for /api/snippets/1 to Caido Replay. Configure the attack:

• Set the snippet ID as the payload position
• Use a numeric payload list (e.g., 1-50)
• Remove the If-None-Match header if present to avoid 304 responses

Launch the attack and analyse the responses. Filter results by response length or status code to identify unique snippets.

Flag Retrieval

Review the Replay results to identify snippets that are not visible in the public dashboard. One of the private snippets contains the flag in the response body.

The flag follows the format bug{FLAG} and can be found by:

• Comparing Replay results against the public snippet list
• Searching response bodies for the flag format
• Identifying snippets where public: 0 indicates private status