Hacker101 CTF: Micro-CMS v1 Part 3

Now moving on to the next challenge.

Here we have something to click on :D. First what I did was clicked on all


I created a page called Just for Fun. If you look the URL and the id, you will see 13. When another page was created, the id was 14. The id for Markdown Test is 2. So, where are other pages from 3-12? Let's check in turn.

404 Not Found Error

• http://35.190.155.168/64fcf8db67/page/3
• http://35.190.155.168/64fcf8db67/page/4
• http://35.190.155.168/64fcf8db67/page/5
• http://35.190.155.168/64fcf8db67/page/6
• http://35.190.155.168/64fcf8db67/page/8
• http://35.190.155.168/64fcf8db67/page/9
• http://35.190.155.168/64fcf8db67/page/10
• http://35.190.155.168/64fcf8db67/page/11
• http://35.190.155.168/64fcf8db67/page/12

For all other id's 404 error was seen except for one.

• http://35.190.155.168/64fcf8db67/page/7 (403 Forbidden)

This means that there is something in this id, it's just not available for us. We are not authorized to view this page. We don't have direct mechanism to access this page too. Let's find the workaround then. If you notice, for every page there is an option to edit the page. When we edit any page, we can see that identifier to the page we are trying to edit. Like for the Testing page http://35.190.155.168/64fcf8db67/page/edit/1

I will now change this 1 to 7 to see the behavior of the page http://35.190.155.168/64fcf8db67/page/edit/7

Voila! there is a flag. This is an example of unauthorized access.