# Sokudo

> BugForge tells me the hint on Sokudo today is ***BAC.***

Todays lab was a difficult one. Not really difficult, but I forgot to test something that I didn't had shizzled down in my notes.

There was an endpoint that was quite 'chatty'. The endpoint `/api/stats` gave back a lot of information, including the user\_id.

<figure><img src="https://2622029278-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FV7OebgUO4GDe408WfphF%2Fuploads%2Ftnf3gd37WKlNCp4S7sKC%2Fafbeelding.png?alt=media&#x26;token=e958bb7e-1660-429e-8f36-8b40e8a6a782" alt=""><figcaption></figcaption></figure>

Whenever we see something like this in a GET request, we should consider if we could

* Change our own data with a PUT request
* Change somebody else's data with a PUT request.

I decided to go straight for that last one because, well, sometimes I'm impatient like that.

<figure><img src="https://2622029278-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FV7OebgUO4GDe408WfphF%2Fuploads%2F9qZce58Pf65iShAwgKMX%2Fafbeelding.png?alt=media&#x26;token=7553cf92-b24f-4cde-aad0-54d72bb86dcf" alt=""><figcaption></figcaption></figure>

{% hint style="info" %}
If you change the request body in BurpSuite, it defaults to `application/x-www-form-urlencoded` , make sure to change this to `application/json` if you're passing JSON.
{% endhint %}

I updated someone else's data, and my reward for doing that was the flag 🇧🇪
