CTF Writeup: A Web Exploitation Warm-Up Chain

This one's a fairly standard warm-up chain, but it's a good example of how small issues compound into a full compromise. Three bugs, chained: an IDOR, a weak JWT secret, and an admin panel that trusted the token a little too much.

Recon

Gobuster turned up an /api prefix that wasn't linked anywhere in the UI:

gobuster dir -u https://target.ctf -w common.txt -x json

/api/users        (Status: 200)
/api/orders       (Status: 200)
/api/admin        (Status: 403)

Bug 1 — IDOR on /api/orders

/api/orders?id=1042 returned another user's order without checking that the requesting session owned it. Bumping the id parameter walked through every order in the system, including one belonging to an account with an admin role flag — enough to confirm the target for privilege escalation.

Bug 2 — weak JWT signing secret

The session cookie was a standard JWT. Running it through hashcat against rockyou.txt cracked the HMAC secret in under a minute:

hashcat -m 16500 jwt.txt rockyou.txt

With the secret in hand, forging a token with "role": "admin" was trivial.

Bug 3 — the admin panel trusted the token blindly

/api/admin never re-validated the role against the database — it just trusted the JWT claim. Dropping the forged token in as the Authorization header returned the flag.

Takeaways

• IDORs are still everywhere, and they're the cheapest way to figure out what to target next.
• Never let a JWT secret be guessable — rotate long, random secrets, and don't roll your own auth glue code.
• Sensitive endpoints should re-check authorization against the source of truth, not just the token's claims.

Full chain, start to flag, took about 25 minutes — most of it spent on recon.