> For the complete documentation index, see [llms.txt](https://notes.dollarboysushil.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://notes.dollarboysushil.com/web-application-pentest/bugforge/idor-insecure-direct-object-reference/tanuki-2.md).

# Tanuki - 2

Level: Easy\
Points: 10\
Type: Daily Challenge

Lab Interface

<figure><img src="https://559802299-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8C3FiojCIEtxH7nox2Do%2Fuploads%2FeShQIKmtKeGfX1yUYxge%2Fimage.png?alt=media&amp;token=7b7c3447-1eb8-4f7f-ac66-d5c5c905e38c" alt=""><figcaption></figcaption></figure>

In /profile we have option to update or profile

<figure><img src="https://559802299-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8C3FiojCIEtxH7nox2Do%2Fuploads%2FOT3bIIDjxhMIozKquBKX%2Fimage.png?alt=media&amp;token=7b34a6c8-0238-4282-abbd-8d0c88e49d6b" alt=""><figcaption></figcaption></figure>

Request to update profile looks like

<figure><img src="https://559802299-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8C3FiojCIEtxH7nox2Do%2Fuploads%2FfJy9l2iQEnbpfUgabygT%2Fimage.png?alt=media&amp;token=e8407dc6-832d-4ea8-8c6a-6c20967ca03e" alt=""><figcaption></figcaption></figure>

Key thing to notice here:\
1\. Email address\
2\. username passed on request

With this info, the first thing that comes in mind, is possibility to update password of other users.\
To test this, I created new account.<br>

And then tried to update password of new account by replacinng email and username in update profile request.

<figure><img src="https://559802299-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8C3FiojCIEtxH7nox2Do%2Fuploads%2Fo343yeB3wr9L2a1X3X3U%2Fimage.png?alt=media&amp;token=1f851d02-04d1-4d93-9a12-276f46ea12cf" alt=""><figcaption></figcaption></figure>

Which worked perfectly and gave me flag.