Hintru ENES ← Todos los labs

Ottergram (BAC + HTTP Verb Tampering) — Bugforge

EN medium CTF challenge BACBroken Access ControlHTTP Verb TamperingIDORAuthorization BypassBurp Suite

Ottergram is a social-media-style web application on Bugforge.io where users browse otter photos. The attack chain is two-stage: first, find functionality you shouldn't be able to reach. Then, find a way past the gate that's supposed to stop you.

0/5
resueltos
👁 Paso 1 Paso 2 Paso 3 Paso 4 Paso 5
recon

Paso 1 · Explore the Ottergram Application

Objetivo: Log in as a regular user and map the application's functionality — understand what endpoints and features are available to a normal user.

Contexto: The target is the Ottergram application on Bugforge.io. Register or log in as a standard (non-admin) user. The app resembles an Instagram-style feed for otter photos, with a home feed, post creation, and a profile section visible in the bottom navigation bar.

Pistas progresivas

Revela solo las que necesites. Claude lleva la cuenta de cuántas usaste para calibrar la retroalimentación.

Pista 1 — empujón direccional

Browse every accessible page and perform actions a normal user can do. Pay attention to all HTTP requests being made — use Burp Suite or your browser's DevTools to capture them.

Pista 2 — técnica / clase de vuln

Look for navigation elements, settings icons, or UI components that hint at functionality beyond the normal user role — especially anything relating to administration or user management.

Pista 3 — casi la solución

The app has a settings/gear icon visible in the top-right of the feed. Click it and observe the request it generates. Also note the profile and post-management endpoints.

Tu intento

Solución oficial

Log in as a regular user (e.g., otter_lover). Browse the home feed and use Burp Suite to capture all requests. Note the gear/settings icon in the top navigation bar. Identify the API endpoints being called for feed, profile, and settings actions.

Criterio de validación: Student maps at least the feed endpoint, profile endpoint, and settings/admin endpoint by intercepting traffic in Burp Suite.

Intentos recientes en este paso

revealed 2026-04-18 16:28:46 · pistas: 3
[solution revealed]

Solution revealed