> For the complete documentation index, see [llms.txt](https://notes.dollarboysushil.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://notes.dollarboysushil.com/web-application-pentest/bugforge/idor-insecure-direct-object-reference/tanuki.md).

# Tanuki

Level: Easy\
Points: 10\
Type: Daily Challenge

Lab Interface

<figure><img src="https://559802299-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8C3FiojCIEtxH7nox2Do%2Fuploads%2FeShQIKmtKeGfX1yUYxge%2Fimage.png?alt=media&amp;token=7b7c3447-1eb8-4f7f-ac66-d5c5c905e38c" alt=""><figcaption></figcaption></figure>

Visiting /stats calls api `/api/stats/4`

<figure><img src="https://559802299-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8C3FiojCIEtxH7nox2Do%2Fuploads%2FyEu3G2PLortHSMCI93fW%2Fimage.png?alt=media&amp;token=60d33a5b-e612-45bf-a21b-388f97ba82af" alt=""><figcaption></figcaption></figure>

Changing the stats to different value gives us the stats of other user.

<figure><img src="https://559802299-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8C3FiojCIEtxH7nox2Do%2Fuploads%2FaHks00zAqSt3n9emMSka%2Fimage.png?alt=media&amp;token=362e2ae6-9180-4510-84c7-6a4e8327fc0f" alt=""><figcaption></figcaption></figure>