Odmen

Platform: CUSTOM | Category: Web | Type: Challenge | Difficulty: Easy | OS: N/A | **Author: XESXOR Techniques: http_parameter_tampering, role_escalation

Summary

Walkthrough of the CUSTOM Web Odmen. A burp category task on the Web Kids 2.0 platform. URL: https://burp.2537ly.space/task4/

Description

A burp category task on the Web Kids 2.0 platform. URL: https://burp.2537ly.space/task4/

Analysis

The task involves manipulating HTTP parameters to change the user role. The name "Odmen" (exchange in Russian) hints at the need to swap or modify parameter values. The flag contains "swswswsw" (swap), which confirms the value swapping technique.

Solution

Step 1: Request Analysis

Intercept the HTTP request and find the parameter responsible for the user role (e.g., role=user). ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Step 2: Role Modification

Change the role parameter value to admin or swap the parameter values.

 bash read-only • copy allowed Copy
# Example with curl - changing role
curl -X POST 'https://burp.2537ly.space/task4/' \
  -d 'role=admin'

# Or swapping parameter values
curl -X POST 'https://burp.2537ly.space/task4/' \
  -d 'param1=value2&param2=value1'

Step 3: Getting the Flag

After successful parameter manipulation, the server returns the flag. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Key Takeaways / Lessons

• Mastering http_parameter_tampering, role_escalation was key to this challenge.
• Always check for common misconfigurations and verify assumptions.

---

Crafted by XESXOR Research • 2026-03-09 • CUSTOM • Odmen • Difficulty: Easy