TryHackMe : Neighbour Walkthrough

Starting the Machine

Start the Lab Machine and AttackBox. Once the machine is running, copy the provided IP address.

Open the machine IP in the browser. The room asks us to find the flag on our neighbour's logged-in page.

1. Find the Login Credentials

We are presented with a simple login page.

At the bottom of the page, we get an interesting hint:

Use the guest account! (Ctrl+U)

Press Ctrl + U to view the page source.

In the source code, we can find the guest credentials:

Username: guest
Password: guest

Username: guest
Password: guest

Log in using these credentials.

2. Access the Guest Profile

After logging in, the application takes us to the guest's profile.

The important thing to notice is the URL:

http://MACHINE_IP/profile.php?user=guest

http://MACHINE_IP/profile.php?user=guest

The username is directly controlled through the user parameter. Since the page source also mentioned an admin account, let's change to:

user=admin

user=admin

3. Exploit the IDOR

Reload the page.

The application now displays the admin's profile without requiring the admin's credentials. This is an IDOR (Insecure Direct Object Reference) vulnerability: the application trusts the user-supplied user parameter without properly checking authorization.

4. Submit the Flag

Submit the displayed flag in the TryHackMe answer box.

Key Takeaway The entire challenge comes down to spotting the vulnerable parameter:

?user=guest

?user=guest

and changing it to:

?user=admin

?user=admin

This demonstrates how an IDOR vulnerability can allow unauthorized access to another user's information.