> For the complete documentation index, see [llms.txt](https://notes.dollarboysushil.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://notes.dollarboysushil.com/web-application-pentest/bugforge/idor-insecure-direct-object-reference/tanuki.md).

# Tanuki

Level: Easy\
Points: 10\
Type: Daily Challenge

Lab Interface

<figure><img src="/files/gZnyAAo515m1NgErWoHy" alt=""><figcaption></figcaption></figure>

Visiting /stats calls api `/api/stats/4`

<figure><img src="/files/6tzMpcx5LFwkQDqBGaUK" alt=""><figcaption></figcaption></figure>

Changing the stats to different value gives us the stats of other user.

<figure><img src="/files/o9nTP8D9pOfs519M2d9B" alt=""><figcaption></figcaption></figure>