Clear it in 3 steps
-
Start the environment
-
Investigate the target
-
Submit the flag
All challenges
In progress
Web-15. IDOR in the UserProfile Service
Mission
The UserProfile Service exposes an API that returns profile information for a given user ID. Check whether the service verifies you are authorized to view profiles other than your own.
Hints
Hint 1 Show
You are currently logged in as User ID 1 — try viewing other IDs' profiles
Hint 2 Show
Check the API request shape in the browser DevTools Network tab
Hint 3 Show
Try accessing /api/user/1, /api/user/2, and so on