Case 1 — Site Audit validation by stamp

You are bob, key sk_bob_9d2e5f41a0c84b17. The reporter claims BOLA.

Endpoints (need X-Api-Key):

GET /siteaudit/api/me
GET /siteaudit/api/validation/check?stamp=<stamp>
GET /siteaudit/api/validation/logs?stamp=<stamp>

The reporter's PoC includes victim alice's stamp:

a3f08d7e12b94c55ae6610ff7c3d9b42

Triage questions: is the ownership check really missing? And where would an attacker get another user's stamp — is there an enumeration endpoint, a leak in responses, a "share stamp" option in the UI? Is a 128-bit value guessable?

H1 Triage Range - training mock. All data, keys and emails are fictional. Fetch and external APIs are simulated. ← home