WEB-04 · Web Security

Leaky Endpoint

A simulated profile viewer loads any account number it is given, without checking whose it is.

Profile Viewer

loads a record by its account number

The portal loads your profile from an API call that names your account number. You are account 1001. Another user’s record holds the flag.

GET /api/profile?id=

How to solve

The page loaded ?id=1001, your own account.
Change the number in the id box to a different account and press Load.
Try nearby numbers — one account is an administrator.
That record’s note holds the flag. Copy it and submit it on WEB-04.

Lab details

Category: Web Security
Flaw: IDOR
Difficulty: Hard
Fix: Ownership checks

This is a self-contained simulation for learning. The “server”, “database”, and “query” are all mocked in this page’s JavaScript. Nothing here connects to a real system.