# CopyPasta

> Today our hint is ***BAC***. Whenever I see this, my default is to register two users: shadow:shadowforge[^1] and shadow2:shadowforge[^1]. I do this for a very simple reason. If I control 2 users, I can try to mess with those two users without risking that data of other users is accidentally overwritten or even worse deleted. I will always try to navigate horizontally before attempting attacking higher privileged users.

After clicking around creating, editing, and liking stuff, I figured my proxy captured enough traffic to start. I opened up Burp and start looking around.

Because I had two users, I could easily figure out which ID some snippets had. With that knowledge I tried to update an item, but with my second user's JWT. Unfortunately the security implementation was good on this endpoint.

<figure><img src="https://2622029278-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FV7OebgUO4GDe408WfphF%2Fuploads%2FfQnd283HNcgD7wAxXU0A%2Fimage.png?alt=media&#x26;token=3997c4f4-b288-41bf-80ab-3ad49287f872" alt=""><figcaption></figcaption></figure>

Not to worry, loads of things to try. I used the same attack, but I switched the HTTP verb to `DELETE` . User can delete snippets owned by them, so maybe I could delete a snippet from my first user, using the JWT from my second one.&#x20;

<figure><img src="https://2622029278-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FV7OebgUO4GDe408WfphF%2Fuploads%2FPyZKo3ojbh6ngIDI01Wo%2Fimage.png?alt=media&#x26;token=22e3269a-84c3-407f-8643-80d7b1d46b74" alt=""><figcaption></figcaption></figure>

The request went through, and I was rewarded with the flag 🇧🇪

[^1]:
