TryHackMe Advent of Cyber 3 Walkthrough — Day 1
This is the first of many walkthroughs that I am writing up, with many more to come. I would love any feedback!
Video Walkthrough: https://youtu.be/MhOTZ93slkM
What is IDOR (Insecure direct object references)? It is an access control vulnerability that arises when an application uses user-supplied input to access objects directly, after that occurs the attacker can gain access to information that is not intended for them.
This is a basic example:
If I were to change this user_id from 1.
to 2.
So if I was logged in to User 1 I would just have to change the user_id and now I would be able to see User 2 without any additional authentication.
AoC3 Day 1- Web Exploitation Save the Gifts
The first thing to do is go through all the information presented on the task to get a better understanding of IDOR.
Question 1:
After finding Santa’s account, what is their position in the company?
Walkthrough: Change the user_id from McSkidys ID to Santas ID by trying values 1–20.
You can see that Santa is user_id 1.
Answer: The Boss!
— — — — — — — — — — — — — — — — — —
Question 2:
After finding McStocker’s account, what is their position in the company?
Walkthrough: Again like with Santa, you will have to cycle through the values of 1–20. We already know that Santas ID is 1 and Mcskidy is 11 so we can skip those numbers.
As you can see above, McStocker is ID 3.
Answer: Build Manager
— — — — — — — — — — — — — — — — — —
Question 3: After finding the account responsible for tampering, what is their position in the company?
Walkthrough: Just like the last 2 questions, change the user_id to every other available number to find out who was responsible for the tampering.
As you can see above the Grinch was responsible, his user_id is 9.
Answer: Mischief Manager
— — — — — — — — — — — — — — — — — —
Question 4:
What is the received flag when McSkidy fixes the Inventory Management System?
Walkthrough: Now that you see who tampered with the system we can revert all of the changes that occurred.
Press revert for every SKU Charge and you find the last flag for Day 1.
Answer: THM{AOC_IDOR_2B34BHI3}
