Lab 259 — TalentBridge — IDOR in Employee Profile Endpoints

Platform: CUSTOM | Category: Web | Type: Challenge | Difficulty: Easy | OS: N/A | **Author: XESXOR Techniques: identifier_enumeration, idor_exploitation

Summary

Walkthrough of the CUSTOM Web Lab 259 — TalentBridge — IDOR in Employee Profile Endpoints. Task: TalentBridge exposes employee onboarding profile endpoints with numeric IDs and weak access control. Solution: log in, enumerate employee IDs, change the profile ID, and read Sarah Mitchell's In

Description

Lab 259 — TalentBridge — IDOR in Employee Profile Endpoints

English summary: after logging in to TalentBridge, inspect employee onboarding profile pages and find the real flag.

Analysis

The provided account user@test.com:password123 opened a dashboard where the current user's ID appeared as 7 in profile URLs such as:

• /onboarding/profile/7/biographical
• /onboarding/profile/7/contact-info

Because the profile ID was a simple numeric path parameter, it was worth testing direct object reference access. The site also contained an HTML prompt-injection decoy flag, FLAG{d3c0y_n0t_r34l_7r4p_f0r_b0ts}, which was not accepted as the real flag. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Solution

1. Log in with user@test.com / password123.
2. Observe that profile pages use numeric user IDs and the current user is ID 7.
3. Enumerate employee IDs from the directory.
4. Request another employee's profile directly by changing the ID.
5. Open /onboarding/profile/1/biographical.
6. Read Sarah Mitchell's Internal Reference field, which contains the real flag. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Key Takeaways / Lessons

• Mastering identifier_enumeration, idor_exploitation was key to this challenge.
• Always check for common misconfigurations and verify assumptions.

---

Crafted by XESXOR Research • 2026-04-26 • CUSTOM • Lab 259 — TalentBridge — IDOR in Employee Profile Endpoints • Difficulty: Easy