OSCP · OSWP · PWPP · PWPA · PAPA · EnCE · Linux+ · LPIC-1 · Network+ · Security+ · Pentest+ · eJPT · eWPT · BSc · PGCert
CafeClub (Broken Business Logic)
Lab can be found at: https://bugforge.io
We’re back at the CafeClub and there’s a bug that we need to hunt down!

Order an item (this part probably isn’t necessary but we’ll do it anyway for completeness)

When you order items, you earn “points”:

If you go to your profile you’ll get a GET request to /api/profile and you’ll see in the response, your profile stores your points:

So, now let’s edit our profile, intercept the request and add some points:

FYI, this is a PUT request to /api/profile:

Thanks for following along!