Oopsie chains several web vulnerabilities into a full system compromise. The attack path starts with guest login credentials hidden in page source, escalates via an Insecure Direct Object Reference (IDOR) to hijack the super-admin account, abuses an unrestricted file upload to plant a PHP webshell, catches a reverse shell, and then escalates privileges via a SUID binary. This is one of the most instructive chains in the Starting Point series.
| Skill | Why it matters |
|---|---|
| Source code analysis for hidden credentials | Developer-left comments and JS files frequently contain credentials and endpoint hints |
| IDOR (Insecure Direct Object Reference) | Manipulating account IDs in requests to access other users' data — OWASP A01 |
| Unrestricted file upload exploitation | Uploading PHP when only images are expected — bypassing weak client-side validation |
| SUID privilege escalation | Finding binaries that run as root regardless of who executes them |
Browse to port 80 — a car rental web application. Check the page source for any interesting comments or JS file references before running any tools.
Inspecting the HTML source reveals a reference to a login page. Browsing to it and inspecting the JavaScript source file exposes guest credentials embedded in the code.
Log in with guest / guest. The application grants limited access. You can browse as a guest but cannot access the upload functionality — that requires a super-admin account.
After logging in, notice the URL and cookies include an account ID and role value. Intercept a request in Burp and examine the cookie:
The user value is a numeric ID and role is controlled client-side. Browse to the Account page — the URL exposes the guest user ID. The application also has an accounts listing page accessible to guests that shows other user IDs.
Refresh. You now have admin-level access including the Uploads section.
role=guest to role=admin is all it takes.Navigate to the Uploads section. The form accepts files — the server-side validation only checks the file extension loosely. Upload a PHP webshell.
Look for SUID binaries — executables that run with the file owner's privileges (often root) regardless of who executes them.
What you're seeing: the binary calls cat with a user-controlled path — but it calls cat without an absolute path. This means you can hijack it by creating a malicious cat binary earlier in PATH.
Oopsie is a masterclass in vulnerability chaining — each step is modest in isolation, but together they go from unauthenticated visitor to root in five moves.
| Concept | Real-world relevance |
|---|---|
| Credentials in JS source | Always read page source — JS files, comments, and config endpoints regularly leak credentials |
| IDOR on role cookie | Never trust client-controlled role or ID values — server must validate privilege on every request |
| Unrestricted file upload | Any upload that accepts PHP on a PHP-enabled server leads to webshell and RCE |
| SUID + relative path | Custom SUID binaries calling system tools without absolute paths are a reliable privesc vector |