Free Utilities
Description
Everyone loves free utilities, don't you? Can you bypass the payment and read other people's bills instead?
Solution
/login to login/register to register
Creds:
test02@ctf.ae:test02@ctf.ae
Only working route is /pay_fees
We are supposed to pay $10k, but we only have $0. Temper with the request and change amount to negative. Now our account has enough money to pay fees.
Giving us money yields no result of flag.
We are redirected to /checkout/<id:int> to see the receipt, but also not much.
Tempering with IDOR /checkout/0 we get the flag
Flag: flag{xOkSO52gXsC2ROhZlylpvYEN1SaUJwgm}
Last updated