TryHackMe: Advent of Cyber - Day 1 - Save the Gifts

This is a write up for the Day 1 - Save the Gifts challenge in the Advent of Cyber room on TryHackMe. Some tasks may have been omitted as they do not require an answer.

---

After finding Santa’s account, what is their position in the company?

Santa is important, so lets assume his user_id=1.

Answer: The Boss!

After finding McStocker’s account, what is their position in the company?

Increment user_id until McStocker is found.

Answer: Build Manager

After finding the account responsible for tampering, what is their position in the company?

Increment user_id until Grinch is found.

Answer: Mischief Manager

What is the received flag when McSkidy fixes the Inventory Management System?

Click ‘Revert’ on all entries under Grinch and the flag will appear.

Answer: THM{AOC_IDOR_2B34BHI3}

Recap

In this task we learnt how to:

• Exploit Indirect Direct Object Reference vulnerabilities