HackerOne CTF - Petshop Pro

Flag 1

When you go to checkout, you submit a URL-encoded body with the post. Insert a new object in there or modify an existing one and insert a negative price to gain a flag.

Flag 2

There is a login form (found through a directory bust). There is a logic error that helps you enumerating user, as a correct username will give you a different error message. Using hydra with rockyou for usernames turns up a valid username fairly quickly. Then you can just use this username and use rockyou for passwords as well, gaining login.

Flag 3

Once you have administrative access, you can edit elements. Edit a specific one in order to obtain a stored XSS in the cart page to obtain a flag.