> For the complete documentation index, see [llms.txt](https://notes.dollarboysushil.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://notes.dollarboysushil.com/web-application-pentest/bugforge/broken-access-control/tanuki.md).

# Tanuki

Level: Easy\
Points: 10\
Type: Daily Challenge

Lab Interface

<figure><img src="/files/6kOAM5ZWtkXMPuFR0hxw" alt=""><figcaption></figcaption></figure>

In `/profile` we have optiont to edit our profile

<figure><img src="/files/j0Ym3UtraLqS9MLsDGSt" alt=""><figcaption></figcaption></figure>

request to update profile

<figure><img src="/files/YyzktAiNdK52zG1wA0jQ" alt=""><figcaption></figcaption></figure>

with this request, the first thing that comes in mind is if we can edit the profile of other user\
so, to test this, i created new account `test@gmail.com`

<figure><img src="/files/0k2SSZgEZjCsfSssYHp4" alt=""><figcaption></figcaption></figure>

then I tried to edit the email and password of `test@gmail.com` and got error `Email already exists or invalid data`

<figure><img src="/files/KdNdUNcodL9kZ2Kalmeu" alt=""><figcaption></figcaption></figure>

Key thing is username is passed in the request `/api/profile/{username}`

so, I tried editing the username and it worked

<figure><img src="/files/bgvzLbaC84CVRlGsM2eR" alt=""><figcaption></figcaption></figure>

There is no ownership check on `/api/profile/{usernname}`, meaning anyone with a valid token can edit the details of anyother account.