All rooms Sign in
WEBLesson + challenge Live machineFree

Broken Ledger

invoice holds an internal reconciliation token you were never meant to see.

Difficulty
Easy
Estimated time
20 min
Points
150 pts
Completions
Completed by 1 player
Authors
By Cyber Academy 4 U
Create a free account to startSign in

What you will learn

  • Broken Object-Level Authorization (BOLA / IDOR) — reading a record by id with no ownership check.
  • Broken Function-Level Authorization — reaching an admin-only endpoint as an ordinary user.
  • Chaining a discovery flaw with an access flaw (OWASP API Security Top 10 — API1 & API5).
  • Reading and replaying simple REST / JSON requests.

What is inside

  1. Task 1 · Broken Ledger1 question

Sign in to read the tasks, start the machine and answer the questions.