Ledger Drift
A small internal accounting application with a self-service export feature and an authorisation model that was written before the tenanting was.
- Difficulty
- Beginner
- Challenges
- 6
- Points
- 480
- Season
- Season 1
The designated free preview room, with full functionality inside it
What the room is
Spoiler-free by policy. No challenge is described in a way that shortens it.
You have an account on a bookkeeping tool used by a fictional logistics company. Everything you need is reachable from the account you are given. The room is built as a first room: six challenges that step from reading the application, through one access control class, to a chained finish, with each challenge naming the concept it teaches so you can look it up rather than guess. There is no brute force anywhere in the room and nothing rewards guessing a path.
What the room exercises
- HTTP request analysis
- Access control testing
- Parameter discovery
- Chaining two low-severity findings
How this room goes
- Completions
- 0
- Median time
- 90 min
- Rating
- Not yet rated
- Ratings
- 0
Median time is the authored estimate. Completion and rating figures are zero because the platform has not launched, and they are shown as zero rather than hidden.
What is behind the sign-in
Gated
The live environment, the challenge list, your per-user flags, the hint tree, and the scoreboard position. Writeups for this room are published by other learners only after the spoiler embargo, and they are moderated before they become indexable.
Worth reading first
Cyber VK Security Curriculum
Pre-publication content owner
Internal ownership label for the web-security curriculum.
Updated
[ Related ]
- LabIDOR in a multi-tenant invoice APIFind an object-level authorisation failure in a tenanted API and demonstrate cross-tenant access without touching another real customer.
- GlossaryInsecure Direct Object ReferenceAn insecure direct object reference is an access control failure in which an application uses a user-supplied identifier to select a record and does not check that the requesting user is allowed to see that particular record.
- GlossaryServer-Side Request ForgeryServer-side request forgery is a vulnerability in which an attacker causes a server to make an HTTP request to a destination the attacker chooses, using the server as the origin of that request instead of their own machine.
- LabBlind SSRF to cloud metadataProve that a server-side request forgery with no visible response can still reach an internal service, and write the finding so a triager cannot close it as informational.
- GlossaryCross-Site Request ForgeryCross-site request forgery is a vulnerability in which a site an attacker controls causes a victim browser to send a state-changing request to a different site where the victim is already authenticated, using credentials the browser attaches automatically.
- ArticleWhy your SSRF report gets closed as informationalMost blind SSRF reports are closed without a payout, and usually for the same three reasons. Here is what a triager is actually looking for, and how to supply it without touching anything you should not.