Capture the FlagEasy
The Account Next Door
Lab for Broken Access Control & IDOR: Reading Other People's Data
Scenario
You're logged in and your account page is keyed by an id in the URL. The app fetches whatever id you ask for, without checking it belongs to you. Your id is 1004. See whose data lives one number over.
Objective
Change the id in a URL to read an account that isn't yours.
lab ~ the account next doornothing real runs
booting lab sandbox…
This sandbox is fully emulated in your browser, nothing real runs and nothing leaves your machine. Type help to see the tools available.