webProeasy
Lab 108 — CostPilot — IDOR via Deprecated v1 API Endpoint
hackadvisor
Task: expense management platform migrated from v1 (numeric IDs) to v2 (UUID-based) API, with deprecated v1 endpoints still partially active. Solution: discover API versioning via X-API-Version header, enumerate /api/v1/expenses/{id} with sequential numeric IDs to access another user's confidential expenses containing the flag.
$ ls tags/ techniques/
idorhoneypotbroken_access_controlapi_versioninguuiddecoy_flagsequential_iddeprecated_endpointexpense_managementnumeric_id
idor_exploitationsequential_id_enumerationhoneypot_detectionapi_version_enumerationdeprecated_endpoint_discoveryresponse_header_analysis
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Sign in with GitHub to continue. No email required.
$sign in$ grep --similar
Similar writeups
- [web][Pro]Lab 99 — CashPilot — IDOR in Team Member Management— hackadvisor
- [web][Pro]Lab 104 — CloudOps Copilot — AI SSRF via Infrastructure Tool Abuse— hackadvisor
- [web][Pro]Lab 116 — InsightForge — IDOR via Undocumented Internal API— hackadvisor
- [web][Pro]Lab 217 — PlanForge — Broken Authorization in Subscription Upgrade— hackadvisor
- [web][Pro]Lab 115 — PulseChat — IDOR in Attachment Download— hackadvisor