💘 TryHackMe Writeup: Valenfind – Can You Exploit This Dating App?

Platform: TryHackMe
Room Name: Valenfind
Category: Web
Difficulty: Medium
Points: 200
Time Estimate: ~60 Minutes

---

🧠 Overview

TryHackMe continues to deliver practical, hands-on cybersecurity challenges, and Valenfind is a fun yet insightful web exploitation room.

The scenario?

A brand-new dating app called Valenfind has been developed by someone who just started coding this year. The challenge hints that it might be “vibe-coded” — meaning it may lack secure development practices.

Your mission:
🔍 Identify vulnerabilities
⚡ Exploit them ethically
🚩 Capture the flag

---

🖥️ Environment Setup

Before starting:

• Launch the AttackBox (if not using VPN)

• Start the Target Machine

• Access the web app at:

  http://MACHINE_IP:5000
  

This ensures you have the correct testing environment to analyze the application safely.

---

🔎 Initial Recon

Once you open the web application, you’ll notice:

• A clean but simple dating interface

• Basic authentication system

• User interaction features

At first glance, it looks polished — but remember:

When someone is new to coding, security is often overlooked.

---

🛠️ Testing Approach (High-Level)

Without diving into exploit code, here’s the structured methodology used:

1️⃣ Application Mapping

• Observed login and registration functionality

• Inspected user inputs

• Checked URL parameters

2️⃣ Input Testing

• Analyzed how user data is handled

• Tested for improper validation

• Looked for logic flaws

3️⃣ Backend Behavior Observation

• Monitored server responses

• Checked for error leakage

• Looked for unintended access paths

---

🚨 Vulnerability Discovery

Through systematic testing, it became clear that:

• Input validation was weak

• Backend logic trusted user input too much

• Sensitive functionality lacked proper protection

This allowed controlled exploitation and ultimately access to the hidden flag.

---

🏁 Final Flag

THM{v1be_c0ding_1s_n0t_my_cup_0f_t3a}

✅ Successfully captured!

---

📚 Key Takeaways

This room reinforces several important cybersecurity lessons:

• 🔐 Never trust user input

• 🧪 Always validate and sanitize data

• 🛡️ Implement proper authentication checks

• 🧩 Logic flaws are just as dangerous as technical exploits

Even simple applications can contain serious vulnerabilities when secure coding practices aren’t followed.

---

🎯 Why This Room Is Valuable

Valenfind is excellent for:

• Beginners transitioning to intermediate web exploitation

• Understanding real-world developer mistakes

• Practicing structured reconnaissance

• Strengthening vulnerability discovery mindset

---

💡 Final Thoughts

“Vibe coding” might feel fast and creative — but without security awareness, it leads to exploitable applications.

This room is a great reminder that:

Secure coding is not optional — it’s essential.