Corridor | TryHackMe Walkthrough

3 min readJan 22, 2026

TryHackMe Corridor is a beginner-friendly challenge room that teaches you how to identify and exploit an IDOR (Insecure Direct Object Reference) vulnerability using simple URL endpoint manipulation and hash analysis. This room is perfect for learning real-world web security concepts like broken access control, MD5 hashing and secure object references in a practical, hands-on environment.

Room Link: https://tryhackme.com/room/corridor

Open the target website in your browser. You will notice that you are standing in a corridor with multiple locked doors. If you count them, you will see there are 13 doors in total. Our goal is to access each one.

When you enter a door, you’ll land in an empty room. However, if you look closely at the URL, you will notice that each room has a unique path made up of a random string, as shown in Picture 02. These random strings are hashes, and each door uses a different hash value.

At this stage, we need to identify what type of hash is being used. We can do this by using free websites such as hashes.com, or by searching for hash identifiers on Google.

After checking, we can confirm that the hash format is MD5 (Message Digest Algorithm 5).

Get Nasir Ahim’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Next, we need to collect all the hashes into a single .txt file so we can organize them properly. Instead of manually opening each door and copying the hash from the URL, we can extract them directly from the source page. Type [ view-source: ] at the beginning of the URL on the corridor page and you will get the source code. Shown in Picture 03.

Once you have all of these hashes, go to CrackStation and crack the hashes. We will notice these hashes are numbers from 1 to 13 individually for each door count. Shown in Picture 04.

This room is designed to demonstrate an IDOR vulnerability (Insecure Direct Object Reference). IDOR is an access control vulnerability where attackers can access unauthorized objects by manipulating user input.

Since the system uses MD5 hashes in the URL to control access to the doors, we can test whether the application properly restricts access. If an IDOR vulnerability exists, we might be able to access a restricted door by entering the MD5 hash of an object that is not listed — such as 0 or 14. Lets get the MD5 hash of 0. We can go to CyberChef for that. Shown in Picture 05.