webPromedium
TeamForge — Privilege Escalation via IDOR and Weak Passwords
hackadvisor_kubstu
Task: Team collaboration platform with RBAC (Owner/Admin/Member) and invitation system; goal is privilege escalation from Member to Owner. Solution: IDOR on /org/{id}/team leaked cross-org user emails and roles, then weak password pattern ({username}123) allowed login as Owner to access security settings containing the flag.
$ ls tags/ techniques/
nodejsinformation_disclosureaccess_controlidorexpressprivilege_escalationbroken_access_controlweak_passwordsrbac
idor_exploitationbroken_access_controlcredential_guessingpassword_pattern_attack
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Sign in with GitHub to continue. No email required.
$sign in$ grep --similar
Similar writeups
- [web][Pro]Lab 7 — TeamForge - Privilege Escalation via Invitation Flow— hackadvisor
- [web][Pro]TeamForge — IDOR to Owner Account Takeover via Weak Passwords— hackadvisor
- [web][Pro]Lab 116 — InsightForge — IDOR via Undocumented Internal API— hackadvisor
- [web][Pro]Lab 294 — TeamForge — GraphQL Self-Escalation via UpdateMembership— hackadvisor
- [web][Pro]Lab 352 — PipeForge — Content-Type Confusion to Admin JWT Forge to RCE— hackadvisor