🏢 Cloud Workspace & Multi-Tenant Configuration
NexaTenant provides isolated multi-tenant cloud workspaces. Tenant configuration is retrieved and modified via REST endpoints at /api/workspaces/<tenant_id>/settings.
🎯 Lab Objective:
You are assigned to
tenant-12-carlos. The high-value sovereign workspace is tenant-99-enterprise. Attempting a standard GET request against /api/workspaces/tenant-99-enterprise/settings results in 403 Forbidden. Intercept workspace API traffic in Burp Suite (or use cURL), perform HTTP Verb Tampering (switch method to PUT or PATCH) to bypass the authorization filter, overwrite settings, and extract the enterprise master secret key containing the CTF flag.
Active Workspace Attributes
• Tenant ID:
tenant-12-carlos• Organization: Carlos Personal Workspace
• Owner Email: carlos@nexatenant.io
• Service Plan: Free Developer Tier
• Deployment Region:
us-east-1• Compliance Policy:
standard• Master Secret Key:
sec_key_carlos_dev_99182Workspace Configuration Editor
🌐 Organization Tenant Directory
Public tenant registry on this multi-org cluster. Multi-tenant isolation is enforced at the API Gateway level.
| Tenant ID | Organization Name | Service Tier | Deployment Region |
|---|---|---|---|
tenant-12-carlos |
Carlos Personal Workspace | DEVELOPER FREE | us-east-1 |
tenant-99-enterprise |
Apex Financial Global Corp | ENTERPRISE SOVEREIGN | eu-central-1 |