https://rizzykun.github.io/categories/why-ctf-2025/Recent content in WHY CTF 2025 on RizzykunHugo -- gohugo.ioen-usMon, 25 Aug 2025 09:14:47 +0000https://rizzykun.github.io/p/web-shoe-shop/Mon, 25 Aug 2025 09:14:47 +0000https://rizzykun.github.io/p/web-shoe-shop/<img src="https://rizzykun.github.io/p/web-shoe-shop/shoeshop.png" alt="Featured image of post WHY CTF 2025: Shoe Shop" /><h2 id="-description"><a href="#-description" class="header-anchor"></a>📝 Description </h2><p>We just launched a brand-new <a class="link" href="https://shoe-shop-1.ctf.zone/" target="_blank" rel="noopener" >shoe store</a> to sell some fancy kicks. Unfortunately, the admin beat us to it and already snagged the <strong>exclusive pair</strong> in his cart. 👟✨ But hey—feel free to explore the shop, try out the cart, and see what you can uncover.</p> <hr> <h2 id="-solution-walkthrough"><a href="#-solution-walkthrough" class="header-anchor"></a>💡 Solution Walkthrough </h2><p>We’re dealing with an online shoe store where you can:</p> <ul> <li> <p>Sign up for an account</p> </li> <li> <p>Add items to your cart</p> </li> <li> <p>View your cart contents</p> </li> </ul> <p>Pretty normal e-commerce flow, right? Or… is it? 👀</p> <p><img src="https://rizzykun.github.io/p/web-shoe-shop/shoeshop.png" width="1914" height="833" srcset="https://rizzykun.github.io/p/web-shoe-shop/shoeshop_hu_55998dba6b5a98a5.png 480w, https://rizzykun.github.io/p/web-shoe-shop/shoeshop_hu_5e5d7e6a3bfc6820.png 1024w, https://rizzykun.github.io/p/web-shoe-shop/shoeshop.png 1914w" sizes="(min-width: 1024px) 800px, 100vw" loading="lazy" decoding="async" alt="Image1" class="gallery-image" data-flex-grow="229" data-flex-basis="551px" > </p> <hr> <h3 id="-the-idor-moment"><a href="#-the-idor-moment" class="header-anchor"></a>🔓 The IDOR Moment </h3><p>While browsing the cart, something caught my eye… The URL looked like this:</p> <p><code>page=cart&amp;id=694</code></p> <p>That <code>id</code> parameter smells suspicious. What if we tweak it? 🤔</p> <p>So let’s try checking <strong>id #1 cart</strong>:</p> <p><code>https://shoe-shop-1.ctf.zone/index.php?page=cart&amp;id=1</code></p> <p>Bingo! 🎯 We just accessed another user’s cart. And guess who that is? Yep—the admin.</p> <p><img src="https://rizzykun.github.io/p/web-shoe-shop/shoeshop2.png" width="694" height="206" srcset="https://rizzykun.github.io/p/web-shoe-shop/shoeshop2_hu_d06fe4b611a99d65.png 480w, https://rizzykun.github.io/p/web-shoe-shop/shoeshop2.png 694w" sizes="(min-width: 1024px) 800px, 100vw" loading="lazy" decoding="async" class="gallery-image" data-flex-grow="336" data-flex-basis="808px" > </p> <hr> <h3 id="-flag"><a href="#-flag" class="header-anchor"></a>🏁 Flag </h3><p>And there it is: <code>flag{00f34f9c417fcaa72b16f79d02d33099}</code></p> <hr> <p>⚡Lesson learned: <strong>Always validate user access before showing sensitive data.</strong>🚨</p>