Odmen

Platform: web-kids20 | Category: Web | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2026-03-09 | Status: Solved Techniques: http_parameter_tampering, role_escalation

Summary

A burp category task on the Web Kids 2.0 platform. URL: https://burp.2537ly.space/task4/

Odmen - Web Kids 2.0

Description

A burp category task on the Web Kids 2.0 platform. URL: https://burp.2537ly.space/task4/

Analysis

The task involves manipulating HTTP parameters to change the user role. The name "Odmen" (exchange in Russian) hints at the need to swap or modify parameter values. The flag contains "swswswsw" (swap), which confirms the value swapping technique.

Solution

Step 1: Request Analysis

Intercept the HTTP request and find the parameter responsible for the user role (e.g., role=user). ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Step 2: Role Modification

Change the role parameter value to admin or swap the parameter values.

 bash read-only • copy allowed Copy
# Example with curl - changing role
curl -X POST 'https://burp.2537ly.space/task4/' \
  -d 'role=admin'

# Or swapping parameter values
curl -X POST 'https://burp.2537ly.space/task4/' \
  -d 'param1=value2&param2=value1'

Step 3: Getting the Flag

After successful parameter manipulation, the server returns the flag. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍