# \[Day 14] Web Applications

Today I am reviewing OWASP's top 10 vulnerabilities and specifically the IDOR vulnerability. First I log into the web application with the given credentials.

![](https://850580359-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSqAgfe92W3tM8LBhIHHu%2Fuploads%2Ftr0B9b2IpERbRmxdPWWe%2Fimage.png?alt=media\&token=34923f24-5dfc-4830-a467-d4a7af40e262)

Next, I increment the values in the URL.

![](https://850580359-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSqAgfe92W3tM8LBhIHHu%2Fuploads%2F7xa9T4UGMvhrNjHTrzTP%2Fimage.png?alt=media\&token=28a5debc-411c-4cc0-a58d-8e0dbbe3fa75)

Once I find that flag I inspect the webpage and find an /images directory. I paste that information into the browser and increment/decrement the values in the URL. I am then granted the flag for this challenge.&#x20;

![](https://850580359-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSqAgfe92W3tM8LBhIHHu%2Fuploads%2FGgNzoAQcnDwmAHHuYxsE%2Fimage.png?alt=media\&token=2a8764a7-c629-4d9d-9e9f-0f217e5e173e)

Here is my sad drawing that illustrates the IDOR vulnerability being used in different folders from the web application. Since we cannot retrieve the flag from the same directory, we have another known directories /images found from inspecting the webpage.&#x20;

![](https://850580359-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSqAgfe92W3tM8LBhIHHu%2Fuploads%2FaSNsIXo8uFSV5XNM2tbM%2Fimage.png?alt=media\&token=f2058949-9057-4478-8e77-9cd6494c1794)

## Flags

### What is the office number of Elf Pivot McRed?

134

### Not only profile pages but also stored images are vulnerable. Start with a URL of a valid profile image; what is the hidden flag?

THM{CLOSE\_THE\_DOOR}
