In the following writeup , I try to tackle and document the lsb from BugForge.io named Galaxy-Dash-006. A Broken Access Control Lab.

Galaxydash-006

On loading the challenge site we get a signup/login form where we are able to create an account and an organization/team.

We register two accounts victim1 and victim2 for test purposes.

Off the rip , the most interesting functionality is the team and add team functionality

This is very interesting since it essentially lets you register accounts through a different avenue. The question is what happens when you provide it with a legit username and a different password, how will it react? Let’s test that

So we add victim2 to our organization and use a different password 123 from his actual password victim2.

Now let’s see if it worked by trying to login as victim2 using his password from before

Lets try the new password 123:

We manage to login as victim 2 and successfully identify the vulnerability: Allows changing user credentials and data by add member to team functionality

Now to solve the lab’s challenge Galaxy Dash have pushed some new updates. For testing you can target user walt

Doing the same to the account walt and logging in we get the flag present in the response

Flag :bug{8PSJ7rIRaPga12lj8u38iFzq8p2kuebC}

Find the lab here —> https://app.bugforge.io