webPromedium
Lab 116 — InsightForge — IDOR via Undocumented Internal API
hackadvisor
Task: analytics platform with React SPA, documented API properly enforces report ownership. Solution: discover undocumented /api/internal/reports/:id endpoint that bypasses authorization, enumerate sequential report IDs to access admin's confidential audit report containing the flag.
$ ls tags/ techniques/
api_enumerationjavascript_analysisidorauthorization_bypassinternal_apireact_spasequential_idsanti_bot_decoys
idor_exploitationsequential_id_enumerationdecoy_flag_identificationjavascript_source_analysisundocumented_api_discovery
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Sign in with GitHub to continue. No email required.
$sign in$ grep --similar
Similar writeups
- [web][Pro]TeamForge — IDOR to Owner Account Takeover via Weak Passwords— hackadvisor
- [web][Pro]Lab 205 — DockForge — SSRF in Webhook Test Endpoint— hackadvisor
- [web][Pro]Lab 58 — ReportForge — SSRF via PDF Export Logo URL— hackadvisor
- [web][Pro]Lab 109 — TaskForge — IDOR in Account Settings API— hackadvisor
- [web][Pro]Lab 300 — PlanForge — Broken Authentication via Hidden Trial Activation— hackadvisor