$#idor

2 writeups

Cartoon pirate face inside a green ring badge

HackTheBoxEasy04 Aug 2026

HTB: Cap

A "Security Snapshot" dashboard lets any user page through other users' packet captures by ID — one of them leaks an FTP password reused for SSH, and a stray Linux capability on python3.8 hands over root instantly.

#idor
#pcap-analysis
#linux-capabilities
#privesc

Pink ghost mascot wearing sunglasses and holding a phone

TryHackMeEasy29 Jul 2026

Hacker Holidays — Day 3: Complimentary

A "free" wellness app hands out unauthenticated Cognito guest credentials, and an over-scoped IAM role lets those guest credentials Scan the entire DynamoDB table instead of just one record.

#hacker-holidays
#cloud
#aws
#idor