Home

Phonebook

Date: 13, May, 2021

Author: Dhilip Sanjay S

Initial Recon

  • Initially I couldn't find the username and password for login. So, I was looking for someother endpoint other than login.

  • I was able to find two other enpoints:

    • 964430b4cdd199af19b986eaf2193b21f32542d0

    • search

Access Denied

  • The 964430b4cdd199af19b986eaf2193b21f32542d0 page had a search box, which made a POST request to the search endpoint. But it kept on returning Access Denied - 403 Error message.

Dumping all the contacts in the phonebook

Login with wild card character (*)

  • On entering the username and password as a wildcard character (*), I was able to login into the site.

Search using regex (.*)

  • Now in the search box, I tried the same wildcard character, but it didn't work.

  • So, I used the regex that matches any string .*, which gave me the following output:

  • But wait, where is the flag??????

Finding the password/flag

  • We'll try to find the password. My intuition is that the password might be the flag.

  • We know that the wildcard character (*) will let us login. So, we can try to append some character before and after the wildcard character (*).

  • So let's try * as the username and HTB{*} as the password, because this the flag format for HTB challenges.

  • Now we are able to login. This confirms that the password is the flag.

  • So we need some script to bruteforce the flag.

Solution

  • We get the password/flag as: HTB{d1rectory_h4xx0r_is_k00l}

PreviousTemplatedNextHTB Academy Overview

Last updated