# Challenges

## CWE-285 Improper Authorization

REST API does not authorize the user. It should check whether the user that is making request is allowed to do so.

![](https://2460584164-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-M2m74sb-YSZ_UxP3c94%2Fuploads%2Fhg5gyX0ZyDKmcg8oeKf5%2Fimage.png?alt=media\&token=767138b5-2150-4fe7-b4d4-299d0205ed45)

![](https://2460584164-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-M2m74sb-YSZ_UxP3c94%2Fuploads%2F6YSdXhYE9gEZ4cuMkx6w%2Fimage.png?alt=media\&token=ecf9ae9b-87b2-4f34-8bc5-ee8bb9577a2f)

## CRUD page generation

‌ Find auto-generated pages, but are not used.

### Solution

`Transaction` controller was generated using Visual Studio. `/Transaction/Edit` (GET, POST) , `/Transaction/Delete` (GET, POST) and `Transaction/DeleteConfirmed` are not used but can be accessed.

You will find the flag in the response header.



## Missing Authentication

In this challenge, you need to find endpoints that should be protected but are not.

### Solution

1. Delete`SessionId` cookie and try all endpoints.
2. When you try/`api/User/GetAvaliableFunds?user={username}` or `/api/User/ProfileImage?user={usernane}` you will find that you don't need `SessionId` cookie.

You will find the flag in the response header.

## Unconfirmed login

In this challenge, you need to access `/Transaction` with an unconfirmed account.

### Solution

1. Register new user
2. Go to `/Transaction` without confirming your account.

You will find the flag inside the page source.



