Explore the application's API to identify exposed documentation and access restricted routes.

#### Requirements
+ Category: API Security
+ Skill: API Enumeration and Exploitation

#### Objective
Start by fuzzing the application to locate the Swagger documentation. Analyze the discovered API endpoints and attempt to access the admin route.

Herra

#### Requirements
+ Programming Language: JavaScript
+ Cross-Origin Resource Sharing (CORS): Filters Bypass

#### Objective
Your goal is to exploit a CORS misconfiguration to steal the admin's `API_KEY`. Begin by logging into the provided credentials and monitoring all HTTP requests. Carefully analyze these requests for potential CORS issues. Conduct tests to identify and exploit the misconfiguration, then craft a malicious link to trick the admin and exfiltrate their `API_KEY`.

#### Credentials:
Admin:
- Username: `voorivex_lab`
- Password: `supersecretpassword`

User:
- Username: `user`
- Password: `user`


GoodCMS

Analyze the application for sections that process XML data and exploit vulnerabilities in its handling.

#### Requirements
+ Vulnerability Type: XML External Entity (XXE)
+ Skill: Data exfiltration via OOB

#### Objective
Identify a section of the application that accepts XML input and produces an independent response. Exploit this functionality to read the `/flag` file.

XXE - Blind

Investigate the application's data parsing functionality and exploit it to access restricted endpoints.

#### Requirements
+ Vulnerability Type: XML External Entity (XXE)
+ Skill: Exploiting SSRF via XXE

#### Objective
Locate a section of the application that accepts JSON data. Convert the JSON to XML and check if the application parses it. If it does, exploit the XML parsing to perform SSRF and access `http://127.0.0.1:3000/admin.php`.

XXE - SSRF

Analyze the uploader functionality to identify weaknesses in its design and bypass file upload restrictions.

#### Requirements
+ Vulnerability Type: Insecure Design
+ Skill: Uploader Tricks

#### Objective
Try to read the `/flag`

Safe Uploader

Explore the application's XML handling functionality to identify and exploit vulnerabilities.

#### Requirements
+ Vulnerability Type: XML External Entity (XXE)
+ Skill: Exploiting XML Parsing

#### Objective
Find a section of the application that processes XML data and generates a dependent response. Exploit the XML parsing to read the `/flag` file and demonstrate the vulnerability.

XXE - Simple

Explore the application's input handling to identify and exploit a mass assignment vulnerability.

#### Requirements
+ Category: API Security
+ Skill: Mass Assignment Exploitation

#### Objective
Investigate the application's forms or API endpoints for mass assignment vulnerabilities. Identify unintentionally writable parameters and exploit this flaw to perform unauthorized actions, such as escalating privileges or modifying restricted data. Use this exploit to achieve the challenge goal.

Otex

This challenge simulates a **real-world IDOR** vulnerability that’s harder to spot. The goal is to exploit an issue with how user IDs are managed in the system.  

### Steps  
1. **Login** into the web application and observe the user’s unique ID.  
2. **Find a way** to disclose other users' IDs. You may need to inspect API calls or analyze the requests in the background.  
3. Use your findings to **access the admin’s attachment (ID: 23)**.  

### Requirements  
- **Knowledge of API Interactions**: You may need to interact with the API to discover hidden endpoints or data.  
- **Exploration of the Application**: Observe how the system handles user IDs and determine if they can be manipulated.  
- **Insecure Direct Object Reference (IDOR)

### Objective  
Your goal is to find a way to **access the admin's attachment** by exploiting an **IDOR vulnerability** in the web application.  


Hack the Object

گواهینامه شرکت در کلاس، نفراتی که در امتحان شرکت نکردند و یا قبول نشدند این گواهینامه را دریافت کرده‌اند