webPromedium
Lab 23 — KeyVault Pro — IDOR in 2FA Device Removal
hackadvisor
Task: enterprise credential management platform with WebAuthn 2FA; team API over-exposes security device info and device removal lacks ownership validation. Solution: chain two IDORs — enumerate admin's WebAuthn credential_id via team API, delete admin's 2FA device as low-privilege user, login with leaked admin credentials, access protected notes containing the flag.
$ ls tags/ techniques/
nodejsinformation_disclosureidorapi_securitybroken_access_control2fa_bypasswebauthncredential_management
api_endpoint_enumerationidor_user_enumerationidor_device_deletion2fa_bypass_via_device_removalcredential_leak_in_announcements
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Sign in with GitHub to continue. No email required.
$sign in$ grep --similar
Similar writeups
- [web][Pro]Lab 341 — KeyVault2FA — SSRF via OTP Account Import— hackadvisor
- [web][Pro]Lab 7 — TeamForge - Privilege Escalation via Invitation Flow— hackadvisor
- [web][Pro]Lab 15 — ProfileHub — IDOR in User Profile API— hackadvisor
- [web][Pro]TeamForge — IDOR to Owner Account Takeover via Weak Passwords— hackadvisor
- [web][Pro]TeamForge — Privilege Escalation via IDOR and Weak Passwords— hackadvisor_kubstu