Hack The Box Web Pentest 2019

Love The Way You Lie 2021-10-30 06:10 247阅读 0赞

[20 Points] Emdee five for life [by L4mpje]

问题描述：

Can you encrypt fast enough?

1594459-20190728211248584-169797106.png

初始页面，不管怎么样点击Submit都会显示”Too slow!”

1594459-20190728211416213-1877571189.png

依据Html源码，编写Python脚本进行利用

1594459-20190728211614844-1452985268.png

  1. import requests
  2. import hashlib
  3. import re
  5. url="http://docker.hackthebox.eu:34650/"
  7. r=requests.session()
  8. out=r.get(url)
  10. rr = re.compile(r"<h3 align='center'>(\S+)</h3>", re.I)
  11. str1 = rr.findall(out.text)
  12. str2=hashlib.md5(str1[0].encode('utf-8')).hexdigest()
  14. data={
  15.     'hash': str2}
  16. out = r.post(url = url, data = data)
  18. print(out.text)

Run result

  1. <html>
  2. <head>
  3. <title>emdee five for life</title>
  4. </head>
  5. <body style="background-color:powderblue;">
  6. <h1 align='center'>MD5 encrypt this string</h1><h3 align='center'>JBUxqcV4rWsw17043rxv</h3><p align='center'>HTB{N1c3_ScrIpt1nG_B0i!}</p><center><form action="" method="post">
  7. <input type="text" name="hash" placeholder="MD5" align='center'></input>
  8. </br>
  9. <input type="submit" value="Submit"></input>
  10. </form></center>
  11. </body>
  12. </html>

[20 Points] Fuzzy [by Arrexel]

问题描述：

We have gained access to some infrastructure which we believe is connected to the internal network of our target. We need you to help obtain the administrator password for the website they are currently developing.

1594459-20190730102956501-1544111480.png

初始页面为一个静态页面

1594459-20190730103519371-726676587.png

发现没有什么可利用的点直接进行站点Fuzz

1594459-20190730214648404-352592644.png

Start

1594459-20190730214359804-1870592343.png

Fuzz可以看出来存在目录api并且api下面还有一个php文件

尝试访问 /api/action.php 发现缺少Parameter

1594459-20190730214755175-1447398899.png

接下来Fuzz Parameter

1594459-20190730233611829-252049119.png

Start

1594459-20190730233307645-2113441243.png

Fuzz到参数reset

1594459-20190730233738784-311307989.png

最后Fuzz ID

1594459-20190730234011739-602762500.png

Start

1594459-20190730234115446-652744731.png

End，Fuzz

1594459-20190730234228075-900699458.png

转载于:https://www.cnblogs.com/qftm/p/11260600.html

发表评论

表情：
评论列表 （有 0 条评论，247人围观）

还没有评论，来说两句吧...

相关阅读