Hashgate
Web Recon
The entry point is a standard login portal. 
Upon inspecting the HTML source code, we discovered hardcoded credentials left in a developer comment:
1
<!-- Email: guest@picoctf.org Password: guest -->
Identifying the Vulnerability
While navigating the application, the URL structure was noted to use a hexadecimal string (MD5 hash) as a user identifier: 
By decoding common integers, we determined that the application generates user profiles based on the MD5 hash. This indicates a predictable pattern that can be exploited via an IDOR attack.
Exploitation (IDOR via Hash Fuzzing)
To find other users, we generated a targeted dictionary of MD5 hashes for the numeric range 3000 to 3100:
Hash Generation Script:
1
seq 3000 3100 | while read n; do echo -n "$n" | md5sum; done | cut -d ' ' -f 1 > md5_list_3000_to_3100
Fuzzing the Endpoint: Using ffuf, we performed a directory brute-force attack against the user profile endpoint to identify valid hashes:
1
ffuf -u http://vulnsite.ctf/profile/user/FUZZ -w md5_list_3000_to_3100
The fuzzer identified two valid hashes. 
Navigating to the second discovered hash granted us access to a higher-privileged profile, revealing the flag. 