THM OWASP Top 10 - grunt92/IT-Sec-WriteUps GitHub Wiki
No answer needed
No answer needed
No answer needed
No answer needed
Enter ls into the shell input.
drpepper.txt
Enter getent passwd to get a list of all users.
0
Enter whoami
www-data
Enter getent passwd | grep www-data the value after the last ":" is the answer
/usr/sbin/nologin
Enter lsb_release -a
18.0.4
Use ls /etc | grep motd to get the directories associated with motd. Then use ls /etc/update-motd.d to get all files within the directory. Use cat /etc/update-motd.d/header00 and search for the answer at the end of the file.
DR PEPPER
No answer needed
Click on "Register" and register as " darren"(with a space in front of the name). Then login with the registered credentials and get the flag.
fe86079416a21a3c99937fea8874b667
No answer needed
Click on "Register" and register as " arthur"(with a space in front of the name). Then login with the registered credentials and get the flag.
d9ac0f7db4fda460ac3edeb75d75e16e
No answer needed
No answer needed
No answer needed
Use gobuster dir --url IP -w /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt in your terminal.
/assets
Navigate to the directory you found in question one. What file stands out as being likely to contain sensitive data?
Navigate to "IP/assets":
webapp.db
Use the supporting material to access the sensitive data. What is the password hash of the admin user?
Use wget IP/assets/webapp.db to download the database and open it using sqlite3 webapp.db. Enter .tables to get a list of all tables. You will see that there is a table called "users". Use SELECT * FROM users to get the answer. The hash is the value after the user name:
6eea9b7ef19179a06954edd0f6c05ceb
Copy the hash and use "crackstation.net" to crack the hash.
qwertyuiop
THM{Yzc2YjdkMjE5N2VjMzNhOTE3NjdiMjdl}
No answer needed
Extensible Markup Language
no
yes
XML prolog
!ELEMENT
!DOCTYPE
!ENTITY
No answer needed
No answer needed
No answer needed
Use the payload <script>alert(/etc/passwd)</script>
falcon
/home/falcon/.ssh/id_rsa
MIIEogIBAAKCAQEA7
No answer needed
No answer needed
Deploy the machine and go to http://MACHINE_IP - Login with the username being noot and the password test1234.
No answer needed
Log in with the given credentials. Change the value of the "note"-parameter to "0" and press enter.
flag{fivefourthree}
No answer needed
Use a search engine such as google to look-up the default password for "Pensive Notes". After you find the credentials you can log in and find the flag.
thm{4b9513968fd564a87b28aa1f9d672e17}
No answer needed
Navigate to http://MACHINE_IP/ in your browser and click on the "Reflected XSS" tab on the navbar; craft a reflected XSS payload that will cause a popup saying "Hello".
Go to the machine-site and register a user-account (use something trivial such as "test:test").
Go to the "Reflective XSS"-subsite and enter <script>alert(Hello)</script> and press the "Search"-button to get the answer.
ThereIsMoreToXSSThanYouThink
On the same reflective page, craft a reflected XSS payload that will cause a popup with your machines IP address.
Insert <script>alert(window.location.hostname)</script>and press the "Search"-button.
ReflectiveXss4TheWin
Now navigate to http://MACHINE_IP/ in your browser and click on the "Stored XSS" tab on the navbar; make an account.
Then add a comment and see if you can insert some of your own HTML.
Navigate to "Stored XSS"-page. Enter <img src=x onerror=alert(1)/> as comment.
HTML_T4gs
Enter <img src=x onerror=alert(document.cookie) />
W3LL_D0N3_LVL2
Insert <script> document.getElementById("thm-title").innerHTML = "I am a hacker"; </script>.
websites_can_be_easily_defaced_with_xss
The Apache Software Foundation
Denial of Service
Select the correct term of the following statement:
if a dog was sleeping, would this be:
A) A State
B) A Behaviour
A Behaviour
Binary
webapp.com/login
HTTPS
Register to the website: On the start-site, inspect the site. Look into the storage and select the "sessionID"-cookie. Copy the value and decode it using base64.
THM{good_old_base64_huh}
In the developer tools change the user type from "user" to "admin". Refresh the site and you get the next flag.
THM{heres_the_admin_flag}
Download the rce.py and edit the file to include your IP and the port you want to use. Execute the python-script and copy the generated payload. Start a listener using nc -lnvp PORT. Click on the 2nd Message: "Exchange your vim". Open the Developer tools and exchange the encoded cookie with the created payload. Click on "Provide your feedback" and a remote shell will open. Change the directory using cd .. and open the file using cat flag.txt to get the flag.
4a69a7ff9fd68
No answer needed
No answer needed
Use exploit-db to find vulnerabilities regarding the bookstore webpage.
Note: Search for "Book Store" instead of "Bookstore" to find a wider variety of possible exploits
Find the exploit for a remote code execution and download the script. Run the script with the MACHINE_IP and you will get a remote shell. After the shell is established run wc -c /etc/passwdto get the answer.
1611
Download the file provided by TryHackMe. Open the textfile. You fill see that there are multiple different logins from the same IP.
49.99.13.16
Brute Force
No answer needed