Manager

Platform: HackTheBox | Category: Mobile | Difficulty: N/A | Author: D3v0o0Nu11 | Date: 2026-02-10

Description

A client asked me to perform security assessment on this password management application. Can you help me?

Solution Approach

Core idea: Identify the weakness from source review or fingerprinting first. Iterate with incremental payloads instead of guessing.

Steps

1. After installed the apk and opened it, enter your host then intercept the request you send at the login page.

INTERCEPT USING BURP

REPEATER

1. Let us create a user then.

CREATING USER (REGISTER)

1. Great at the response tab we can see our role and id.
2. This could be IDOR vuln, but there's no id parameter at the request.
3. After logged in, we have an update feature which we can utilize to change other user password by their id, if there is id parameter when we do update request.

DO REQUEST - Opened manage.php - turns out there is no id param.

1. Stuck for a while until i tried to register a username admin and it says username already taken.

CREDS ENUMERATION VULN

1. Knowing this, Try to change the password again but this time change the username as admin and the password as random strings.

Do login again using the account we've made before and intercept request for update account.

1. Now let us do login again.

2. Got the flag!

Flag

REDACTED

Lessons Learned

1. Identify the weakness from source review or fingerprinting first.
2. Iterate with incremental payloads instead of guessing.
3. Reuse the same pattern in future engagements.