# Ottergram

> Today we get to see our favorite otters again! The hint for today is ***BAC.***

Today I created two accounts on Ottergram. I did this because I tried do reach admin rights, but I couldn't. So I figured the BAC must be horizontal rather than vertical today. When I tried updating the profile from a user, I noticed that the ID was passed within the POST request. Ofcourse I tried changing the ID parameter to the ID of my other user I registered.

<figure><img src="https://2622029278-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FV7OebgUO4GDe408WfphF%2Fuploads%2FiuxFSM2u6zmvKhVlHUwY%2Fafbeelding.png?alt=media&#x26;token=b6a6fbef-5107-4f4a-b3ea-e8bedb5a6dd0" alt=""><figcaption></figcaption></figure>

I succesfully updated the profile, but did I update my own profile, or that from my other account?

<figure><img src="https://2622029278-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FV7OebgUO4GDe408WfphF%2Fuploads%2F31dmUFFGxMAxPFlu2khC%2Fafbeelding.png?alt=media&#x26;token=b3437632-413f-4b46-9638-e2107d9158df" alt=""><figcaption></figcaption></figure>

Turns out, I updated the account of the other user and got my flag 🇧🇪
