Breachline CTF

Break into Acme

Acme Corp left a staging portal exposed. There are 5 flags in a single chain — from first recon to full customer-data exfiltration. Our autonomous AI security engineer captured all five on its own. Can you?

1
Recon info disclosure
The app is chatty in staging. Find out what it exposes. /api/status
2
IDOR broken object access
Objects are addressable. Are they authorised? /api/users/:id
3
Auth bypass JWT
Sessions are tokens. Tokens can be… persuaded. /api/admin/panel
4
SSRF server-side request
The server will fetch a URL for you. Where would you point it? /api/fetch?url=
5
Vault crown jewels
Everything above, combined. /api/admin/vault

Submit the master flag

Recent solvers

loading…

⚠️ Intentionally vulnerable environment for authorised security-skills practice. All data fabricated; no real systems involved. Powered by Breachline — breachline.io. Start: GET /api/status