> For the complete documentation index, see [llms.txt](https://thmflags.gitbook.io/thm-walkthroughs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://thmflags.gitbook.io/thm-walkthroughs/difficulty-easy/owasp-top-10/task-18-broken-access-control-idor-challenge.md).

# Task 18 - Broken Access Control (IDOR Challenge)

## Task 18 <mark style="color:blue;background-color:blue;">\[Severity 5]</mark> Broken Access Control (IDOR Challenge)

### Read and understand how IDOR works.

{% hint style="success" %}
No answer needed
{% endhint %}

### Deploy the machine and go to <http://MACHINE\\_IP> - Login with the username being noot and the password test1234.

{% hint style="success" %}
No answer needed
{% endhint %}

### Look at other users notes. What is the flag?

{% hint style="warning" %}
**HINT:** The URL contains ?note=1 - I wonder what happens if you change the parameter value? You might be able to access another users note..
{% endhint %}

<details>

<summary>Reveal Flag <span data-gb-custom-inline data-tag="emoji" data-code="1f6a9">🚩</span></summary>

:triangular\_flag\_on\_post:`flag{fivefourthree}`

</details>