🏴☠️ Josh’s challenge: IDORable Bistro
🗺️ Location: Sasabune - Area: sasabune. Coordinates: 7, 3
Dialogue before Finishing ACT I
I’m a teetotling hacker.
I sleep about 4 hours a night.
Photography is my hobby, but the anachronistic sort: before 1900.
Teaching people how to hack and protect systems is my passion.
Not yet. Come back later… I might have something interesting for you.
Dialogue after Finishing ACT I and before finding the receipt
I need your help with something urgent.
A gnome came through Sasabune today, poorly disguising itself as human - apparently asking for frozen sushi, which is almost as terrible as that fusion disaster I had to endure that one time.
Based on my previous work finding IDOR bugs in restaurant payment systems, I suspect we can exploit a similar vulnerability here.
I was…at a talk recently…and learned some interesting things about some of these payment systems. Let’s use that receipt to dig deeper and unmask this gnome’s true identity.
Did you see that receipt outside the door?
Dialogue after finding the receipt
Oh, you found that receipt? Perfect!
Dialogue after solving the challenge
Excellent work exploiting that IDOR vulnerability - textbook execution.
Now we know exactly which gnome tried to pass itself off as a sushi connoisseur. Frozen rolls… honestly, what’s next?
Dialogue after completing HHC2025
Excellent work! You’ve demonstrated textbook penetration testing skills across every challenge - your discipline and methodology are impeccable!