Neighbor TryHackMe WriteUP

Hi everyone We're back with another challenge called Neighbour

Let's dive straight to the issue,

Before diving to the vulnerable website, let's understand what is IDOR

IDOR (Insecure Direct Object Reference) is a type of access control vulnerability where an attacker can access unauthorized data by manipulating user-supplied input, such as a URL parameter or an ID number.

Start your AttackBox and the target Lab machine. Once the Lab machine is up, we can find our vulnerable website IP address

In this walkthrough, http://10.49.165.91 is the vulnerable target website. Open Firefox inside your AttackBox and navigate to this IP address.

So, as you can see a login page but we are told if you don't have a account ,you should use guest account

Now, Let's see view page source or simple press (ctrl+U)

Notice the line written in the HTML comment. It instructs us to use guest:guest as credentials since the admin panel is off-limits. Type guest for both the username and password on the login page.

Press login , or Enter

Now, you will see a Welcome page , but pay attention to the URL

Let's modify the URL parameter to target the admin account.

As you can see, once the user parameter is changed to admin, we bypass access controls, gain entry to the admin page, and capture our flag!

The Flag : flag{66be95c478473d91a5358f2440c7af1f}

• Alish