API recon: finding hidden parameters
An undocumented REST API backs the site. Discover the endpoints and a hidden parameter that unlocks a price override.
Scenario
The single-page frontend talks to /api/.... There is no published documentation,
but the JavaScript bundle and predictable paths reveal most of it.
Your objective
Enumerate the API, find the parameter that lets you change an order total, and place an order for the leather jacket at a lower price. Solved when the discounted order is accepted.
Capture 2 flag(s) and record the exact technique for each step.
Getting started
- Proxy the app and list every
/api/request the frontend makes. - Request
/api,/api/,/openapi.json,/swagger.json, and read the JS bundle for path strings. - For the order endpoint, diff the
GETobject fields against what thePOST/PATCHaccepts — look forprice,discount,total. - Send the hidden parameter and confirm the total changes.
- Submit the endpoint path and the parameter name as the two flags.
Connecting
Press Launch Lab to build your own instance, then use the How to connect panel — it shows the browser link as soon as the app is running. Hit Stop when you are done, or Relaunch / Reset for a clean copy.
Credentials: wiener:peter
Hints
Tip
Try an unexpected HTTP method (OPTIONS, PATCH) on a known path — the response often lists what is allowed.
How to connect
Connect to the lab VPN first
Lab machines sit on an isolated network with no public address. Connect to the VPN once — the same config works for every lab.
1 · Get your config
Download rooted-labs.ovpn2 · Connect
Linux / macOS — from a terminal:
Windows / mobile — import the file into OpenVPN Connect, Tunnelblick, or the OpenVPN GUI.
3 · Reach the machine
Once connected, the address shown below (SSH command / lab link / RDP command) is reachable. Only lab traffic is routed through the VPN — your normal internet is untouched.
Step 2 — reach the machine
Open the lab in your browser:
Open labCredentials: wiener:peter
The app can take a few more seconds to finish booting after the link appears.
Starting the container — your link will appear here automatically.
Launch the lab (sidebar) to get your link.
SSH into the machine:
Password for rabbit:
Log in as rabbit (has sudo). First login may take a few seconds while SSH finishes starting.
Provisioning — the SSH command will appear here when the machine is ready.
Launch the lab (sidebar) to get the SSH command.
Challenge questions
0 / 2 correct- Submit the initial flag you recovered while solving this lab.
- Which vulnerability class does this lab cover? (a few words)
On this page
Access
FREEAt a glance
- Operating system
- Web application
- Connection
- Browser / HTTP
- Questions
- 0 / 2 solved
- Launched by
- 0 hackers
- Maintained by
- Faustino Luettgen
Your machine
Status
Booting your machine — this takes about a minute. Connection details appear in the brief below when it's ready.
Ready — see How to connect below.
Provisioning failed. Hit Relaunch to try again.