Ottergram

Today we get to see our favorite otters again! The hint for today is BAC.

Today I created two accounts on Ottergram. I did this because I tried do reach admin rights, but I couldn't. So I figured the BAC must be horizontal rather than vertical today. When I tried updating the profile from a user, I noticed that the ID was passed within the POST request. Ofcourse I tried changing the ID parameter to the ID of my other user I registered.

I succesfully updated the profile, but did I update my own profile, or that from my other account?

Turns out, I updated the account of the other user and got my flag 🇧🇪