# Indoor WebApp

{% hint style="info" %}
Category: Web

Difficulty: very easy
{% endhint %}

## Description

<figure><img src="https://2661951449-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPXl4YE7Y3W2ZkuPwt8SF%2Fuploads%2Fs16O9v454D6tIWUnHMRs%2Fimage.png?alt=media&#x26;token=7d6681d2-3850-4402-9a8a-19ed67cc5f97" alt=""><figcaption></figcaption></figure>

## Solve Walkthrough

* Given a web app that we can see personal information, but notice that every person is have unique id: `?user_id` value parameters.

<figure><img src="https://2661951449-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPXl4YE7Y3W2ZkuPwt8SF%2Fuploads%2Fg05xMKI564eJZzbR7cSG%2Fimage.png?alt=media&#x26;token=2f63f237-de8c-4577-9284-cd123eb1c6dc" alt=""><figcaption></figcaption></figure>

* I try to change it to person **2** or `?user_id=2` and I got the flag.

<figure><img src="https://2661951449-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPXl4YE7Y3W2ZkuPwt8SF%2Fuploads%2FiW2paii0X13idacJOntc%2Fimage.png?alt=media&#x26;token=90f2aee7-1ddb-4287-a7b8-b06aaea26ede" alt=""><figcaption></figcaption></figure>

* We can perform brute force attack to check if the spesific `user_id` is exist or not by using **Burp Suite** or simply **cURL** (combined with for/while loop).

<figure><img src="https://2661951449-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPXl4YE7Y3W2ZkuPwt8SF%2Fuploads%2F4HNbJa4tpBvMZxk59xQ6%2Fimage.png?alt=media&#x26;token=c03c4bec-4af7-4da7-8d74-7387de886fc1" alt=""><figcaption></figcaption></figure>

* Luckily, we just have 3 available users.

## Flag

<kbd>OSCTF{1nd00r\_M4dE\_n0\_5enS3}</kbd>
