Challenges completed
Completed THM rooms IDOR and CSRF
What I learned
-
What CSRF is and why it is dangerous
-
How CSRF works
- Common spots for CSRF
-
How to find CSRF vulnerabilities
-
What an IDOR is
-
Where IDOR can be located
-
Finding IDORs in
- Hashed IDs
- Encoded IDs
- Unpredictable IDs
Commands, tools, and techniques
Record useful commands, payloads, filters, or problem-solving techniques.
Problems and dead ends
The biggest problem that I’m running into is how THM labs are really slow when you are working with more than one machine, e.g. having a target machine and then a attackbox, it’s probably better to start using OpenVPN to connect than doing everything on the thm site.
What I will revisit
- More hands practise with IDOR and CSRF