TryHackMe Neighbour — Walkthrough

Introduction

TryHackMe — Neighbour

Neighbour is a beginner-friendly web security room that demonstrates an Insecure Direct Object Reference (IDOR) vulnerability. The objective is to investigate a simple login portal and determine whether it is possible to access another user's profile information.

Note:_ The following walkthrough is based on the steps and screenshots you provided._

1. Start the Lab Machine

Start the Neighbour machine from TryHackMe.

Once the machine is running, you'll be provided with an IP address.

In this lab, the target IP was:

10.48.136.21

10.48.136.21

Navigate to the web application:

http://10.48.136.21

http://10.48.136.21

A login page will appear.

2. Inspect the Page Source

At the login page, use:

Ctrl + U

This opens the page source.

While reviewing the source code, we can find an interesting HTML comment:

<!-- use guest:guest credentials until registration is fixed. "admin" user account is off limits!!!!! -->

<!-- use guest:guest credentials until registration is fixed. "admin" user account is off limits!!!!! -->

This comment reveals default credentials:

Username: guest
Password: guest

Username: guest
Password: guest

3. Log in as Guest

Return to the login page and enter:

Username: guest
Password: guest

Username: guest
Password: guest

After submitting the credentials, the login succeeds, and we are taken to the user's profile

4. Examine the URL

After logging in, look carefully at the URL:

http://10.48.136.21/profile.php?user=guest

http://10.48.136.21/profile.php?user=guest

The interesting part is:

user=guest

user=guest

This parameter appears to determine which user's profile is displayed.

Instead of changing anything else, we can test whether the application properly verifies that the authenticated user is allowed to access the requested profile.

Change:

user=guest

user=guest

to:

user=admin

user=admin

So the URL becomes:

http://10.48.136.21/profile.php?user=admin

http://10.48.136.21/profile.php?user=admin

The admin profile contains the flag.

Key takeaway

Never trust user-controlled parameters to determine which resources a user can access._ Authentication confirms_ who the user is, while authorization must determine what that user is allowed to access.