Задачник

Platform: hackerlab | Category: Web | Type: Challenge | Difficulty: Easy | OS: NA | Author: XESXOR | Date: 2026-04-04 | Status: Solved Techniques: IDOR via predictable hash-based resource identifier, Username enumeration by deterministic SHA-256 mapping

Summary

Task: Flask/Gunicorn notes service where user posts are exposed at /posts/<sha256(username)>. Solution: compute sha256(admin), request the corresponding page, and read the flag from admin notes due to broken access control.

Задачник — hackerlab

Description

Задачник

English summary: the target was a Flask/Gunicorn notes application. After authentication, the application redirected each user to /posts/<sha256(username)>. That identifier was predictable and the server did not enforce ownership, resulting in an IDOR / broken access control vulnerability.

Solution

Recon

Unauthenticated users could access the standard /login and /register pages. After registering and logging in, the application redirected to: ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

 text read-only • copy allowed Copy
/posts/<sha256(username)>

Creating a test note confirmed that this value was not random and did not represent a secret token. It was simply the deterministic SHA-256 hash of the username.

That meant an attacker could generate candidate paths for guessed usernames such as admin.

Exploitation

The vulnerable pattern was simple:

1. Register a normal account.
2. Log in and observe the redirect format /posts/<sha256(username)>.
3. Infer that other users' notes use the same mapping.
4. Compute sha256("admin").
5. Request /posts/<sha256(admin)>. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

The application returned the admin user's notes instead of denying access, proving the route lacked a proper ownership check.

One of the admin notes contained the flag. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍