# Ottergram

> Are favorite otters are back! This time with the hint ***comments are fun***

When we go to the comments, we see that we can edit them.

<figure><img src="https://2622029278-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FV7OebgUO4GDe408WfphF%2Fuploads%2FpIF24M0ZnQCsSjZ2Qiv2%2Fimage.png?alt=media&#x26;token=b59c2a5b-7321-4081-8ddf-71f0166478bc" alt=""><figcaption></figcaption></figure>

When we edit a comment, we see that the id is given in the PUT request, but it seems like the protection to see if a comment is really yours comes from the JWT.

<figure><img src="https://2622029278-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FV7OebgUO4GDe408WfphF%2Fuploads%2F1TthYNKBa7qtckJsVZAR%2Fimage.png?alt=media&#x26;token=e9e62814-7f9a-43c8-a53c-9c618016133f" alt=""><figcaption></figcaption></figure>

So probably the token isn't going through a `jwt.verify` , let's change the id to test this theory.

<figure><img src="https://2622029278-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FV7OebgUO4GDe408WfphF%2Fuploads%2FWlKkSHo637gIWHvTlMGC%2Fimage.png?alt=media&#x26;token=1f95b0c3-1771-4584-b928-2f9a0cd053bd" alt=""><figcaption></figcaption></figure>

So yeah, the token becomes invalid if we tamper with it. Let's go back to our original token, so we have a valid one and try to change another comment.

<figure><img src="https://2622029278-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FV7OebgUO4GDe408WfphF%2Fuploads%2FNQ9YSc1RlAwnsUYnGI0x%2Fimage.png?alt=media&#x26;token=497697a0-ef8b-48bd-8f92-afff84e346e7" alt=""><figcaption></figcaption></figure>

Well, that didn't go as planned!

So what now? I tried signing it with an empty key and the `none` attack. But those too came back with invalid token.

<figure><img src="https://2622029278-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FV7OebgUO4GDe408WfphF%2Fuploads%2FwUsET10tt7WYZrP4tmwn%2Fimage.png?alt=media&#x26;token=585c5240-2159-403c-b308-172d98db9600" alt=""><figcaption></figcaption></figure>

After questioning my capabilities as a pentester, I decided to go to my `sanity check` , and there was something there I hadn't tried.

<figure><img src="https://2622029278-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FV7OebgUO4GDe408WfphF%2Fuploads%2Fnxysb3djRRgLf0QmWMbk%2Fimage.png?alt=media&#x26;token=26307d74-6e48-4d85-b6a6-473d60aa2036" alt=""><figcaption></figcaption></figure>

Well, if it's in my checklist, I just probably try it right?

<figure><img src="https://2622029278-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FV7OebgUO4GDe408WfphF%2Fuploads%2FgqAoOoHkOreMB9yEi1Lo%2Fimage.png?alt=media&#x26;token=a0d6b19d-6231-4368-bde5-92b55795ac6b" alt=""><figcaption></figcaption></figure>

The request went through, no check whatsoever!

<figure><img src="https://2622029278-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FV7OebgUO4GDe408WfphF%2Fuploads%2FgJZiDzW5kbywOyzSBRkB%2Fimage.png?alt=media&#x26;token=3c9ffe72-4ee7-4b95-9e1f-030c4fd0d956" alt=""><figcaption></figcaption></figure>

And there it was, my well deserved flag 🇧🇪

{% hint style="info" %}
Always, and I mean always, keep your notes close and update them if you solved a problem. Your notes are golden!
{% endhint %}
