webeasy
Задачник
hackerlab
Task: Flask/Gunicorn notes service where user posts are exposed at /posts/<sha256(username)>. Solution: compute sha256(admin), request the corresponding page, and read the flag from admin notes due to broken access control.
$ ls tags/ techniques/
IDOR via predictable hash-based resource identifierUsername enumeration by deterministic SHA-256 mapping
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Create a free account with GitHub to get started.
$ssh [email protected]