Challenge 31 of 66

Identity Thief

🟠 Hard Web App +100 XP

An API returns user data at /api/user/1001. Your account is 1001. Change the ID to access the admin account at ID 1.

Identity Thief // sandbox

IDOR = Insecure Direct Object Reference. Just change the number in the URL.

Know someone who would enjoy this? Challenge them.

Keep going

Make it count. Join free to earn XP for what you read and solve, keep a streak, and track your progress.