Beta

This catalog is a work in progress — I'm actively polishing it and adding new labs.

0xBugLabs
← All labs
EasyAccess Control / IDOR

Acme HelpDesk — ticket access control

A small internal support-ticket portal for Acme Corp customers. You're given a low-privilege customer account — everything else you find is yours to discover, the same way you'd approach an in-scope target with a test account on a real program.

Node.jsExpressEJS

Run it locally

git clone https://github.com/G3kSec/0xBugLabs.git
cd 0xBugLabs/labs/idor/helpdesk-ticket-access
docker compose up -d

The app is at http://localhost:8080. Tear down with docker compose down.

Objectives (2)

  1. 01

    Read another customer's ticket

    Every ticket you're supposed to see belongs to your own account. Find a way to read one that doesn't.

    ▸Hints (2) — stuck? optional, no spoilers
    1. 1.Open one of your own tickets and look at the URL. What identifies which ticket you're viewing?
    2. 2.The ticket ID is sequential and the app trusts whatever ID you give it — it never checks that the ticket actually belongs to you.
  2. 02

    Reach the internal agent console

    There's a staff-only view of the support queue. Your account is a regular customer, not staff.

    ▸Hints (2) — stuck? optional, no spoilers
    1. 1.The customer UI never links to a staff area. That doesn't mean the route isn't there.
    2. 2.Try common staff paths directly in the URL bar while logged in as a regular customer.
idorbroken-access-controlhorizontal-privilege-escalationmissing-function-level-access-control
View lab source →Solution walkthrough (spoilers) →