Challenge Overview

Target: https://santacloud.intigriti.io/home

Vulnerability: Insecure Direct Object Reference (IDOR)

Flag: INTIGRITI{019b118e-e563-7348-a377-c1e5f944bb46}

TL;DR

Found exposed backup file → Leaked credentials → Authenticated access → IDOR on notes API → Admin's private note contained the flag.

The Hunt Begins: Reconnaissance

Starting with the basics, I checked for robots.txt:

<https://santacloud.intigriti.io/robots.txt>

image.png

The file revealed an interesting disallow entry pointing to backup files. Following common backup naming conventions, I tried:

<https://santacloud.intigriti.io/composer.json~>

image.png

Bingo! The backup file was publicly accessible.

Notes: It’s a part of flag which is INTIGRITI{019b118e-e563-734 in the secret value. However, it’s not completed flag which should be ended with } char.

Discovery: Plaintext Credentials

Inside composer.json~, I found hardcoded credentials (a classic developer mistake):

{
  "admin-access": {
     "username": "elf_supervisor",
     "password": "CookiesAndMilk1337",
  }
}

🚩 Security Lesson #1: Never commit credentials to version control or leave backup files exposed.