THM: Neighbour Write-up

📰 Medium · Cybersecurity

Learn how to exploit IDOR vulnerabilities to gain unauthorized access to admin accounts

intermediate Published 22 Apr 2026

Action Steps

Navigate to the given URL and view the page source to look for potential vulnerabilities
Look for comments or hidden text in the page source that may give hints about the vulnerability
Try logging in as a guest to see if there are any restrictions or access controls
Attempt to change the user parameter in the URL from 'guest' to 'admin' to exploit the IDOR vulnerability
Research and learn more about IDOR attacks and how to prevent them

Who Needs to Know This

This tutorial is useful for cybersecurity professionals and penetration testers who want to learn about IDOR attacks and how to exploit them

Key Insight

💡 IDOR attacks involve exploiting insecure direct object references to gain unauthorized access to sensitive data or accounts

Key Takeaways

Learn how to exploit IDOR vulnerabilities to gain unauthorized access to admin accounts

Full Article

Title: THM: Neighbour Write-up

URL Source: https://medium.com/@natchapon.srh/thm-neighbour-write-up-0425f07e32e4?source=rss------cybersecurity-5

Published Time: 2026-04-22T01:59:10Z

Markdown Content:
# THM: Neighbour Write-up - Natchapon Srh - Medium

[Sitemap](https://medium.com/sitemap/sitemap.xml)

[Open in app](https://play.google.com/store/apps/details?id=com.medium.reader&referrer=utm_source%3DmobileNavBar&source=post_page---top_nav_layout_nav-----------------------------------------)

Sign up

[Sign in](https://medium.com/m/signin?operation=login&redirect=https%3A%2F%2Fmedium.com%2F%40natchapon.srh%2Fthm-neighbour-write-up-0425f07e32e4&source=post_page---top_nav_layout_nav-----------------------global_nav------------------)

[](https://medium.com/?source=post_page---top_nav_layout_nav-----------------------------------------)

Get app

[Write](https://medium.com/m/signin?operation=register&redirect=https%3A%2F%2Fmedium.com%2Fnew-story&source=---top_nav_layout_nav-----------------------new_post_topnav------------------)

[Search](https://medium.com/search?source=post_page---top_nav_layout_nav-----------------------------------------)

Sign up

[Sign in](https://medium.com/m/signin?operation=login&redirect=https%3A%2F%2Fmedium.com%2F%40natchapon.srh%2Fthm-neighbour-write-up-0425f07e32e4&source=post_page---top_nav_layout_nav-----------------------global_nav------------------)

![Image 1](https://miro.medium.com/v2/resize:fill:32:32/1*dmbNkD5D-u45r44go_cf0g.png)

# THM: Neighbour Write-up

[![Image 2: Natchapon Srh](https://miro.medium.com/v2/da:true/resize:fill:32:32/0*xssq2kTNIlzPqHuQ)](https://medium.com/@natchapon.srh?source=post_page---byline--0425f07e32e4---------------------------------------)

[Natchapon Srh](https://medium.com/@natchapon.srh?source=post_page---byline--0425f07e32e4---------------------------------------)

Follow

Just now

[](https://medium.com/m/signin?actionUrl=https%3A%2F%2Fmedium.com%2F_%2Fvote%2Fp%2F0425f07e32e4&operation=register&redirect=https%3A%2F%2Fmedium.com%2F%40natchapon.srh%2Fthm-neighbour-write-up-0425f07e32e4&user=Natchapon+Srh&userId=126ef97e8270&source=---header_actions--0425f07e32e4---------------------clap_footer------------------)

[](https://medium.com/m/signin?actionUrl=https%3A%2F%2Fmedium.com%2F_%2Fbookmark%2Fp%2F0425f07e32e4&operation=register&redirect=https%3A%2F%2Fmedium.com%2F%40natchapon.srh%2Fthm-neighbour-write-up-0425f07e32e4&source=---header_actions--0425f07e32e4---------------------bookmark_footer------------------)

Share

สวัสดีครับ, ใน ห้องนี้คำถามมีอยู่ว่า “Find the flag on your neighbor’s logged in page”

Step1: navigate url ที่ให้มา

Press enter or click to view image in full size

![Image 3](https://miro.medium.com/v2/resize:fit:700/1*f4Vfje8COZHkG67QPZ4XKA.png)

Step2:ผมก็ view page source ก่อนเลย ดูว่ามีอะไรในcodeหรือเปล่าเพราะโจทย์บอกให้หาflag ใน log in page

Press enter or click to view image in full size

![Image 4](https://miro.medium.com/v2/resize:fit:700/1*3Q_2U4DGyxj4dCdVKVrRXg.png)

ผมเจอ ข้อความcomment บอกว่าให้ลอง guest credentials และยังมีบอกอีกว่า admin user account is off limit เหมือนบอกใบ้ว่าต้องเกี่ยวกับสิทธิการเข้าถึงแน่ๆอะไรประมาณนั้น

## Get Natchapon Srh’s stories in your inbox

Join Medium for free to get updates from this writer.

Subscribe

Subscribe

- [x]

Remember me for faster sign in

Step3:ผมก็เลยลอง log in as a guest เข้าไปดู

Press enter or click to view image in full size

![Image 5](https://miro.medium.com/v2/resize:fit:700/1*OpOC17Am4jNaTUfg7iunmA.png)

ได้หน้าต่างแบบนี้มา ซึ่งดูไม่มีอะไรพิเศษแต่ผมสังเกตุไปเห็นที่ URL มีเขียนว่า user=guest

Step4:ผมเลยลองเปลี่ยนจาก guest เป็น admin ผมก็เลย ได้ flagมา

ผมก็ไปศึกษาต่ออันนี้เค้าเรียกว่า IDOR Attack [Insecure Direct Object Reference] ซึ่งก็คือ เปลี่ยน user=guest line to user=admin เพื่อ ให้เราได้ unauthorized access ใน admin account

Thank you for reading kub

[Cybersecurity](https://medium.com/tag/cybersecurity?source=post_page-----0425f07e32e4--------------------------

Read full article → ← Back to Reads

THM: Neighbour Write-up

Key Takeaways

Full Article

Related Videos