HACKR.GG
HACKR
Roadmap
Academy
Pricing
Blog
Resources
...
Labs
→
Account Statements
⚑ Report a problem
IDOR
Easy
Account Statements
FirstBank's statement viewer takes an account number in the URL. It never checks who you are.
↗ View walkthrough
// Machine control
Checking session...
// Submit flag
Submit