🐀 0 pts earned

API Users

🧩 ExposedAPI

🖧 AD Network — ExposedAPI

API Users 🔒 API Profile 🔒 API Auth 🔒 API Admin 🔒 API Fetch

Classic BOLA/IDOR on a user API. GET /api/v1/users/2 returns the admin object which includes an ssh_password field. Only admin can SSH, so the IDOR is mandatory. Root is sudo ruby GTFObins.

Target IP Log in to reveal

User Flag Pending

Root Flag Pending

Community

Community Hints

Grade A · 1000 pts Grade B · 700 pts Grade C · 400 pts Grade D · 200 pts + 150 credits on accept

Short, stage-specific nudges — directional, spoiler-light, no exact commands.

No community hints yet — be the first to add one!

Community

Community Walkthroughs

Grade A · 2500 pts Grade B · 1750 pts Grade C · 1000 pts Grade D · 500 pts + 300 credits on accept

🔒 Walkthroughs are spoilers — capture the root flag on this machine to unlock them for free.