Lab 259 — TalentBridge — IDOR in Employee Profile Endpoints

Platform: hackadvisor | Category: Web | Type: Challenge | Difficulty: Easy | OS: NA | Author: XESXOR | Date: 2026-04-26 | Status: Solved Techniques: identifier_enumeration, idor_exploitation

Summary

Task: TalentBridge exposes employee onboarding profile endpoints with numeric IDs and weak access control. Solution: log in, enumerate employee IDs, change the profile ID, and read Sarah Mitchell's Internal Reference.

Lab 259 — TalentBridge — IDOR in Employee Profile Endpoints — hackadvisor

Description

Lab 259 — TalentBridge — IDOR in Employee Profile Endpoints

English summary: after logging in to TalentBridge, inspect employee onboarding profile pages and find the real flag.

Analysis

The provided account user@test.com:password123 opened a dashboard where the current user's ID appeared as 7 in profile URLs such as:

• /onboarding/profile/7/biographical
• /onboarding/profile/7/contact-info

Because the profile ID was a simple numeric path parameter, it was worth testing direct object reference access. The site also contained an HTML prompt-injection decoy flag, FLAG{d3c0y_n0t_r34l_7r4p_f0r_b0ts}, which was not accepted as the real flag. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Solution

1. Log in with user@test.com / password123.
2. Observe that profile pages use numeric user IDs and the current user is ID 7.
3. Enumerate employee IDs from the directory.
4. Request another employee's profile directly by changing the ID.
5. Open /onboarding/profile/1/biographical.
6. Read Sarah Mitchell's Internal Reference field, which contains the real flag. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍