Hard
Vulnerability class hidden
Northbound — client portal
A multi-tenant consultancy client portal. One low-privilege account, an assessment brief, and nobody tells you what is broken.
PentestingHere Academy
Official Academy lab
- Attempts
- 3
- Solves
- 2
- Published
- 15 Sep 2026
The engagement
Northbound is a multi-tenant consultancy client portal. You have been given one low-privilege member account and an assessment brief. Nobody tells you what is broken this is a real application, most of it working as intended.
Your account
p.morgan@acme-robotics.test / Autumn2026!
Goal
Work the four objectives in order, each proven by its own flag. Start with the data you can already see, and follow it further than you were meant to.