WEB / WRITEUP
NNS CTF 2026 - Web Hacker 2
*THIS CTF WRITEUP IS IN PROGRESS
This challenge was a beginner level web exploitation challenge that we thought would be fun to run through. After all, sometimes it is nice to log an easy capture and refresh yourself on some of the basics. We were given a really straight forward challenge introduction that simply asked if we have ever hacked a website before and to start here. It gave us a link to visit:
So, we visit the URL and are met with a page that asks us to take a look at the query parameter in the URL and think about how this might be abused by a hacker. The parameter here is page=1. This should be easy enough as this is what is called an IDOR attack (Insecure Direct Object Reference) and all this kind of attack requires is the simple changing of a URL parameter on a page that is missing an access control check.
So, all we have to do here is change page=1 to page=2 and that should allow us to move to the next page. We change the parameter and bing, we are able to move on to the next step of the challenge…
<- IDOR ->
