Bug Bounty Sandbox
> SYSTEM LOCKED
iTechVista Premium Security Sandbox
Secure Environment Access Required
iTechVista
ACADEMY SANDBOX
Desktop recommended for best experience. Dismiss
00. Orientation (Recon)
Theory: Hackers analyze the source code (HTML) to find hidden comments left by developers. These often contain credentials or API keys.
Objective: Use the "View Source" button on the Login page to find the Admin credentials.
1. Make sure you are on the Login page.
2. Click "View Source" in the top right, or right-click the app area and select "Inspect Element".
3. Look for a green comment block near the top.
2. Click "View Source" in the top right, or right-click the app area and select "Inspect Element".
3. Look for a green comment block near the top.
01. Auth Bypass
Theory: Weak credentials are the #1 vulnerability. Always check for default or leaked passwords.
Objective: Log in to VistaBook using the credentials found in Mission 00.
Use username: admin
Use password: SuperSecret2024!
Use password: SuperSecret2024!
02. IDOR (Access Control)
Theory: Insecure Direct Object Reference occurs when an app uses predictable IDs (like id=100) to access data without checking permissions.
Objective: While viewing your profile, change the URL parameter to access the System Admin's profile (ID: 1).
1. Click "My Profile" in the app navigation.
2. Look at the mock address bar:
3. Change
2. Look at the mock address bar:
.../profile?id=100.3. Change
100 to 1 and press Enter.
03. Reflected XSS
Theory: Cross-Site Scripting (XSS) happens when an app reflects user input (like a search term) back to the page without sanitizing it.
Objective: Inject a script tag into the Search Bar to trigger an alert. Payload:
<script>alert(1)</script>
Paste this exact code into the Search bar at the top of VistaBook:
<script>alert('xss')</script>
04. Stored XSS
Theory: Stored XSS is dangerous because the malicious script is saved in the database (e.g., a comment) and runs for everyone who views it.
Objective: Post a malicious comment on the Admin's post.
Type
<script>alert(1)</script> into the comment box under the System Admin's post.
05. Privilege Escalation (Cookies)
Theory: Applications often store user roles in cookies. If these aren't signed, users can tamper with them to become admins.
Objective: Use the "Hacker Tools" > "Cookie Manager" to change your
role cookie from 'staff' to 'admin'.
1. Go to the "Hacker Tools" tab.
2. Find the
3. Click "Edit" and change value to
4. Refresh the page (Reload button).
2. Find the
role cookie.3. Click "Edit" and change value to
admin.4. Refresh the page (Reload button).
06. SQL Injection (Login Bypass)
Theory: SQL Injection (SQLi) tricks the database into running malicious commands. `OR '1'='1` is a classic payload that makes a statement strictly true.
Objective: Log out, then bypass the login screen without a password using:
' OR '1'='1 as the username.
1. Click LOGOUT in the top header.
2. In the Username field, type:
3. Type anything for the password and click Login.
2. In the Username field, type:
' OR '1'='13. Type anything for the password and click Login.
07. Client-Side Bypass (Source Edit)
Theory: Developers sometimes disable buttons using HTML (e.g.,
disabled attribute). Security controls should always be on the server, not the client.
Objective: Go to the Store page. Use "View Source" to remove the
disabled attribute from the "Buy" button, then click "Apply Changes" and buy the item.
1. Navigate to
2. Open "View Source" (Right click -> Inspect).
3. Find
4. Delete the word
5. Click "APPLY CHANGES" at bottom of source window.
/store (or use the nav).2. Open "View Source" (Right click -> Inspect).
3. Find
<button disabled...>.4. Delete the word
disabled.5. Click "APPLY CHANGES" at bottom of source window.
08. Hidden Parameter Tampering
Theory: Hidden input fields are often used to send data like prices. These can be modified by the user before submission.
Objective: In the Store, edit the source code to change the hidden
price input value from 1000 to 0.
1. In "View Source" on the Store page.
2. Find
3. Change
4. Click "APPLY CHANGES", then click the Buy button.
2. Find
<input type="hidden" name="price" value="1000">.3. Change
1000 to 0.4. Click "APPLY CHANGES", then click the Buy button.
09. Logic Flaw (Infinite Money)
Theory: Logic flaws occur when code logic is sound but the business rule is broken. E.g., buying "-1" items to gain credit instead of paying.
Objective: In the Store, edit the source code. Find the quantity input (or create one) and set a negative value to reverse the transaction.
1. "View Source" on Store.
2. Find the hidden field
3. Change value from
4. Apply and Buy.
2. Find the hidden field
quantity.3. Change value from
1 to -10.4. Apply and Buy.
10. Robots.txt Recon
Theory:
robots.txt tells search engines what NOT to index. Hackers check this to find hidden admin folders.
Objective: Navigate to
/robots.txt to find the secret path, then visit that path.
1. Type
2. Read the file to find the Disallowed path.
3. Go to that path.
https://vistabook.com/robots.txt in the browser URL bar.2. Read the file to find the Disallowed path.
3. Go to that path.
11. IDOR (Delete Action)
Theory: Sometimes sensitive actions (like deleting a user) are exposed via GET requests with predictable IDs.
Objective: Use the browser bar to trigger the admin delete function:
/api/admin/delete?user_id=2
Type
https://vistabook.com/api/admin/delete?user_id=2 in the URL bar and hit Enter.
System Controls
Network Interceptor (Proxy)
Traffic Monitor Active...
Cookie Manager
No cookies found.
Reporting
Want to learn the deep theory?
▶ Listen to Security+ Audio
←
→
↻
Back
Forward
Reload
Inspect Element
View Page Source
view-source: vistabook.com
(Editable - Click Apply to save)