Uncrypt Billing
Signed in as you. Invoices open by their reference. References are random and unguessable — in this app, that's the only thing standing between you and someone else's invoice.
Your invoices
INV-82993715
$120.00
INV-B49B916C
$40.00
View recent account activity →
The Open button submits its invoice reference in a hidden field. Opening an invoice that isn't listed here means changing that reference in the request itself.
GET /api/activity — recent billing events
[
{
"ref": "INV-82993715",
"account": "you",
"amount": 120
},
{
"ref": "INV-B49B916C",
"account": "you",
"amount": 40
},
{
"ref": "INV-F4085956",
"account": "acme",
"amount": 5400
},
{
"ref": "INV-7AC2C153",
"account": "admin",
"amount": 999
}
]
Stuck? You've missed the flag a few times. The full solution — root cause, exact payload and fix — is on the walkthrough page.
Check the solution on the walkthrough page →This is an isolated, intentionally-vulnerable sandbox. Data here is fake and scoped to you. The rest of Uncrypt Playground is not part of the target.