Capstone: The Ravens' Panel

Every lab so far isolated one bug so you could learn it cleanly. Real attacks are rarely that tidy: a single medium-severity flaw is often a dead end, and the serious breaches come from chaining several together, each one unlocking the next. This capstone is that chain — the last stand of the Ravens’ panel.

The target

The Ravens’ panel is a multi-page app, and you arrive as a guest. Three weaknesses sit in it, none fatal alone:

1. An id leak (IDOR). The Members page returns any member’s API-key hint with no ownership check.
2. A predictable session. Your own session string reveals its format — role:hint:checksum — so a leaked hint lets you forge an admin session.
3. A template injection (SSTI). The admin-only report tool renders your template against a context that holds the master key.

The method

Walk the chain in order: leak the admin’s hint from Members, compare it to your own session to work out the checksum rule and forge an admin session, then use that session to open the report tool and make the template print config.master. The master key only falls when all three links are joined.

Why it matters

This is how real-world and bounty-grade compromises are built — a path, not a single click. And the defensive lesson is the same in reverse: you do not need to be perfect everywhere, but you must break the chain at every link. An ownership check on Members, a random signed session, or a report tool that never renders user input — any one of them alone stops the whole attack.

Open the lab and take the panel down.