NeoVault

hackthebox

Task: NeoVault banking app (Next.js + Express API) exposes both /api/v1 and /api/v2; most v1 routes report deprecation but one download-transactions v1 handler still trusts a client-supplied _id. Solution: enumerate the API from Next.js static chunks, map usernames to MongoDB ObjectIds via the v2 inquire endpoint, then abuse the version-confusion IDOR to download any user's transaction PDF and extract the flag from the decoded PDFKit text streams.