> For the complete documentation index, see [llms.txt](https://notes.dollarboysushil.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://notes.dollarboysushil.com/web-application-pentest/bugforge/idor-insecure-direct-object-reference/tanuki-2.md).

# Tanuki - 2

Level: Easy\
Points: 10\
Type: Daily Challenge

Lab Interface

<figure><img src="/files/gZnyAAo515m1NgErWoHy" alt=""><figcaption></figcaption></figure>

In /profile we have option to update or profile

<figure><img src="/files/Ju6tDmtSUQ0QwGr9BAjX" alt=""><figcaption></figcaption></figure>

Request to update profile looks like

<figure><img src="/files/Sn9o55GDhhcd9STJSUZn" alt=""><figcaption></figcaption></figure>

Key thing to notice here:\
1\. Email address\
2\. username passed on request

With this info, the first thing that comes in mind, is possibility to update password of other users.\
To test this, I created new account.<br>

And then tried to update password of new account by replacinng email and username in update profile request.

<figure><img src="/files/ssgKYKBjZfJrou6u9Kh7" alt=""><figcaption></figcaption></figure>

Which worked perfectly and gave me flag.