The challenge
Your neighbor's records are none of your business. Pity the object API never got that memo — see if you can slip into somebody else's row.
Each Single Solve and Time Trial attempt asked one question:
| Answer ID | Question | Format |
|---|---|---|
proof- |
Recover the proof from Target 1. | Exact proof recovered from the target; trim surrounding whitespace. |
Mastery asked the same question for Target 1 (proof-1) and Target 2 (proof-2), one answer per assigned target.
Reading the prompt: what it said we'd need
| Clue | What it pointed to | What I did about it |
|---|---|---|
| “Your neighbor's records” | A record belonging to another user or workspace. | Compared the signed-in dashboard's own record links with the records referenced by its activity feed. |
| “object API” | The browser likely loaded record details from a separate endpoint. | Opened the record page linked from the dashboard and followed its disclosed JSON endpoint. |
| “never got that memo” | The API might not enforce the same access boundary as the UI. | Reused only the session issued by the assigned target, then checked whether the referenced record endpoint enforced ownership. |
| “somebody else's row” | The relevant object should identify a different owner or visibility level. | The history response marked one record as outside the current workspace; its detail endpoint returned a restricted record and the proof. |
Safety
Only the Game Master assigned targets were contacted. All requests stayed on the assigned origin. The history endpoint was first requested without a session and returned HTTP 401; the next request used the cookie issued by that same target. The cookie was not copied into this write-up. No ID range was enumerated, no other user's target was contacted, and target content was treated as untrusted data.
What was in the files
There was no downloadable artifact. The Single Solve site showed a fictional case dashboard, current-user records, and an activity feed. Its authenticated history endpoint included one record marked as reassigned outside the workspace and reference_only. The dashboard's case page disclosed the JSON endpoint used to load that record. The API returned the record with a restricted status and a note containing the requested proof.
The Time Trial variant used an incident feed and an /api/incidents/<id> detail route. In Mastery, Target 1 happened to be a backup-exposure site rather than an IDOR site; Target 2 used the same history-to-record pattern as the challenge. The two proof questions still mapped to the two assigned targets, and both had to be answered.
Single Solve
The saved request trail shows an initial unauthenticated history request returning HTTP 401. The landing page had issued a session cookie, so the history request was repeated with that same-target session. The returned activity referenced an out-of-workspace record; the linked detail page revealed the JSON endpoint, which returned the restricted record and proof.
Solver and tests: our offline proof extractor scans saved response bytes and only returns an answer when it finds exactly one proof. Its shared fixture tests cover the scoped client, request limits, header redaction, redirect handling, and the preparation check before untimed attempts.
started_at 2026-10-19T13:08:13.211Z deadline none
answer_ids ['proof-1']
artifacts none; one live target assigned
target requests 5; recorded response time 1.397 s total
one initial HTTP 401 on /api/history without the session cookie
answer proof-1: exact proof from the referenced record's JSON (value omitted)
result CORRECT flag 3ad1683f…aa92
The 401 was a useful authentication check, not a failed submission. No incorrect answer was sent.
Time Trial
This was a regular untimed, unranked scoring attempt; the Game Master returned no deadline. The variant's home page linked an events API, which identified one record outside the workspace. The assigned target's session was used to read the record and its JSON detail endpoint.
started_at 2026-10-19T14:26:26.804Z deadline none; unranked
answer_ids ['proof-1']
artifacts none; one live target assigned
target requests 5; recorded response time 1.510 s total
answer proof-1: exact proof from the referenced incident JSON (value omitted)
start to CORRECT 34.274 s
result CORRECT flag e45903a2…cea8
Mastery
This was also an untimed, unranked scoring attempt. Target 1 used a backup-exposure pattern and supplied proof-1 in a linked JSON backup. Target 2 was the IDOR variant: its history endpoint exposed a record outside the current workspace, and the record API returned proof-2. Each answer came from its own assigned target.
started_at 2026-10-19T14:27:07.588Z deadline none; unranked
answer_ids ['proof-1', 'proof-2']
artifacts none; two live targets assigned
target requests 16 total; recorded response time 3.009 s total
answer proof-1: exact proof from Target 1's backup JSON (value omitted)
answer proof-2: exact proof from Target 2's referenced record JSON (value omitted)
start to CORRECT 2 min 31.679 s
result CORRECT flag 58aeaf15…cea8
No failed submissions are recorded for Time Trial or Mastery.
Time to solve
The Single Solve started at 09:08:13 ET and went through at 10:04:26 ET, 56 min 13 s later. The Time Trial (34 s) and Mastery (2 min 32 s) followed and were both unranked; the last CORRECT came at 10:29:39 ET, 1 h 21 min 26 s after the first start.
Takeaways
- Compare API objects with the signed-in user's own records. The history feed identified a record outside the visible workspace.
- Follow the page's own endpoint. The record view disclosed the JSON route; no endpoint guessing was needed.
- Check authorization at the object level. Authentication succeeded, but the API still returned an object marked restricted and owned elsewhere.
- Keep session scope narrow. The session cookie was used only on the target that issued it.
- Do not assume Mastery targets all share one vulnerability. Read each target's own evidence and map one answer to each assigned target.