IDOR Vulnerability

---

In this blog:

• NMAP.

• Inspecting page source.

• Hash-identifier.

• Crackstation.net and Cyberchef.

• Link to the room at the end.

---

Running NMAP

Starting the attackbox, we can start an nmap scan with the supplied IP address which shows that the http service on port 80 is open.

Scanning for hosts using nmap.

---

Inspecting page source

When accessing the website, all we see is a generic website with an image.

Home page.

Clicking CTRL+U (or right click + view page source) takes us to this page which shows some hash values seemingly pointing to each of the doors.

Viewing the page source.

---

Hash-identifier

I will be opening up my kali Linux machine in virtual box to try and test the hashed values to identify the hash algorithm so I can find out what value (if any) the hashed strings are referring to in the Query component of the URL.

Trying one of the strings shows us that it is in fact an MD5 hash.

Using hash-identifier.

---

Crackstation.net and Cyberchef

Trying one of the strings in crackstation.net, we get that they are referring to certain values that are given to each door. The value for this door is 2.

Crackstation.net Click to go to the website.

We can use CyberChef to input custom values and output an MD5 hash that we can inject into the query and find the flag.

Typing 2 into the input gives us the same hash as the one we see in crackstation.net.

Trying hash algorithm with MD5. Click to go to the website.

So trying the number 0 we get this hash.

Checking other values.

Putting the string in crackstation.net confirms that the value is 0.

Checking the hash value in Crackstation again.

Copying this into the Query after the IP address in the URL, retrieves us our flag.

Finding the flag.

---

Try the Room yourself here:

➡️ https://tryhackme.com/room/corridor

---