modules

[silver heron]

@rustic sage you still have a space/new line character there - rendered as a space between admin and !. I was stuck with other challenges already when using https://www.base64encode.org/, where I had to click on Perform URL safe encoding. The best is to use || $ echo "admin" | base64 || to get the proper value.

[tough fjord]

Or you can use burpsuite decoder tab

[rustic sage]

Thanks to all of you guys helping me to understand the part where I was stuck. Now it is passed. Cheers !

[pseudo basin]

Hey, I'm doing the Windows Fundementals module rn and I'm on the first assignment thing. It's asking me to connect to the windows machine with the command xfreerdp /v:10.129.3.198 /u:htb-student, but when I do that, it asks me for a password...

oh I see it now... nvm

[rustic sage]

I passed that if you need any help you may DM-me @pseudo basin

[pseudo basin]

I'm having some trouble connecting to the rpd through the vm. I tried both in my kali and in the parrotos that is there by default. It always says that the connection failed. I did get it to open one time but it crashed like 2 min after

[tough fjord]

if doing it from own vm are you using the vpn?

[pseudo basin]

I tried doing it from my own kali VM with a vpn, and I tried from the htb parrotOS

it worked before idk why its not working now

also, the parrotOS is increadibly laggy. Is there anyway to speed it up?

[tough fjord]

i think they are currently eu based for this - whereabouts are you?

also were you using the specific vpn for that module? not the normal htb vpn pack

[pseudo basin]

I'll try using a vpn tho, I think I might've been connected to Canada when it worked

no... nothing is working

I tried to vpn into the uk, I restarted the parrtOS and the ratget IP but it's still not working. It also didn't work in my kali

[south dome]

Where are information about how you earn cubes? I got 30 without buying, is it something everyone get in beginning and then you need to buy to get more? Or are there other ways to get cubes?

[tough fjord]

upon signing up you get 30 cubes. As of now the only way to get cubes is by buying them. However completing courses rewards you with cubes back (e.g. the tier 0 will cost you 10 cubes, but reward you with 10 cubes for completing them)

[proven hound]

I dunno How I typed that. Sorry

[tough fjord]

Haha. Its ok. I do that all the time on mobile

[proven hound]

I'm not on mobile..lol I am leaning over one laptop to work on another, which is running 2 VMs..

[cobalt nest]

Yo, currently doing web requests module. At the "POST Method" , I have tried to enter admin:password and keep getting login failed. reset the target 4-5 times and still getting same "login failed" I can intercept but cant get any futher as it wont let me get cookies . any help would be appreciated man

[tough fjord]

you have to login with guest:guest

and then escalate to admin somehow 😉

[cobalt nest]

yeah , got it think im getting close 😄

haha thanks

[tough fjord]

cool

I solved that one last night

[cobalt nest]

i should read stuff more clearly then ask for help 😄

[tough fjord]

lol

[jagged pond]

dude Philo i was the same last night. once it finally hit me what i was doing wrong....face palm

[wispy shadow]

This saved me just now... I was getting super frustrated and feel so much better now that I know it's intended to be that way. lol

[pseudo basin]

hey can I get some help on the Windows Services & Processes section?

I am trying to find the non-standard service running on the host, but there are way too many services and I've looked for a while

How do I know if it's non-standard?

[pseudo basin]

Found it. Not sure why it was that one tho...

[tough fjord]

can you dm me reasons Nokline - will pass it on to the team to see if something needs clarifying

I know birb has done that module

[cyan salmon]

hey boys! I just finished the registration process and I'd like to note the link the bot gives doesn't work if you don't switch to classic

Jesus are there really 4k people in this?

[wide olive]

[tough fjord]

In what?

[vapid crescent]

and then escalate to admin somehow 😉
@tough fjord wait what? That's great on actual htb boxes, but on a basic module on web requests, I would expect the example to behave as the description says it should.

[tough fjord]

the module gives you all the info you need

to apply to that exercise

I completed it the other night

[vapid crescent]

I will look around. 🙂 Just found it a bit puzzling because I wasn't expecting it.

[tough fjord]

yeah. the aim is to get you thinking about what was covered, and then applying it.

[vapid crescent]

But that's also a good lesson.

[tough fjord]

if you need any more help shoot me a dm. But try to explore it a bit and don't over think it

it's not as hard you think it might be

[vapid crescent]

Even if it was, I like banging my head on the wall a bit to learn.

[tough fjord]

me too 😄

sticks in the memory better

[vapid crescent]

I would just suggest some kind of disclaimer on that page, to make it somewhat expected that something may require some extra work.

Otherwise it's likely to generate an inflow of "hey something is broken" requests for the foreseeable future.

[tough fjord]

thanks for the feedback - the team do monitor these things and we pass recurring items on around clarity etc.

[rustic sage]

Hello, may i ask a question about executing exploits over ssh tunnels

[tough fjord]

which module from the academy is that in? If it's a generic question try in #general

[rustic sage]

Ok this is actually why i asked, wasn't sure if this is the right place, i'll go head over there thanks

[tough fjord]

no problem

[cobalt nest]

doing the PUT mod on web requests now , getting the OPTIONS and its working fine ... but then when I PUT /hello.txt .. im getting 500 internal server error.. anyone help ?

[tough fjord]

are you giving it the data it needs as well?

[cobalt trench]

How do I submit the flag correct when it says "key=DECODED_KEY"?

Tried "key=actualdecodedkey", tried "actualkey=actualdecodedkey", tried HTB{actualdecodedkey}

[drifting knoll]

@cobalt trench which module & section?

[feral ferry]

JavaScript Deobfuscation within decoding (page 9)

I have tried 7h15_....... etc

and also the B64 encoded value of that string

[drifting knoll]

JavaScript Deobfuscation within decoding (page 9)
@feral ferry
solved

[rustic sage]

do I need a new account for academy ?

I can't just log in with my htb account

[drifting knoll]

@rustic sage yes you have to create a new account

[rustic sage]

very silly

but ok

[full vigil]

Htb academy is like tryhackme

[urban sage]

0auth for HTB is sites is coming at some point. Just not hear yet. @rustic sage

[pseudo basin]

whats better?

[full vigil]

whats better?
@pseudo basin same question

[pseudo basin]

honestly either way I'm sticking with HTB cause I dont wanna switch to a diff platform

[urban sage]

Well this is the HTB server... What do you think our answer to that question is? 🙃

[hard epoch]

i don't understand the question

[pseudo basin]

lmao

[urban sage]

@hard epoch Where is that from?

[pseudo basin]

I think I answered that but looking at it now it is kinda confusing lol

[hard epoch]

@urban sage Learning Process modules

[full vigil]

The whole cubes thing is really complex, can’t there be a monthly cost

[blissful verge]

@full vigil have you worked through any of the modules yet?

[full vigil]

No I have not

I just hope I have enough money to pay for it

Need to check the cost out

[drifting knoll]

@hard epoch

[pseudo basin]

now this makes a lot more sense lmao

[blissful verge]

Everyone has a certain amount of access free. All of the tier0 modules. I’d like to hear your feedback after you’ve tried it out. These modules go quite in depth with accompanying machines and labs

[full vigil]

Everyone has a certain amount of access free. All of the tier0 modules. I’d like to hear your feedback after you’ve tried it out. These modules go quite in depth with accompanying machines and labs
@blissful verge oh, okay

Sure

[hard epoch]

thanks @drifting knoll @rustic sage i solved it

[alpine dagger]

dunno if this'd be the place for it... but I went to sign up on Academy and it's complaining about my name having "illegal characters". My name is João. It's 2020. Srsly?

[tough fjord]

Will pass it on - but i know sometimes depending on how it is done sometimes it gets flagged as zalgo rather than a standard character

I will pass it on to the team

[alpine dagger]

thanks @tough fjord !

[cobalt trench]

@feral ferry
solved
@drifting knoll how to send the flag??

7h1.......

[drifting knoll]

@cobalt trench read the question carefully

[cobalt trench]

I'm doing s****=7h1********

ay got it

@drifting knoll thanks

[drifting knoll]

you're welcome

[rustic sage]

can anyone give me a hint (web request module - POST Method) ?

[spare crane]

anyone able to assist on the web request got a question

its about the GET request part

HOLY SHIT I DID IT NEVER MIND

but can someone message me i still have a question

[tough fjord]

@rustic sage whats up?

And well done @spare crane whats the question?

[rustic sage]

@tough fjord I read the chapter 5 times and worked trough but still not getting admin access. the hint "cookies" did not helped me , can you give me another hint

[tough fjord]

Did you inspect the cookie? Decode it? See what it is etc?

[rustic sage]

yes, I did decode it. I dont know what I should do with it

[tough fjord]

Dm

[green mason]

wow, no available instances for now

how many instance does it support? 😄 does anyone knows?

[rustic sage]

anyone else had problems on the LFI module?

I'm using the command given in the tutorial but I get an error in the log file

don't know if I'm being stupid of if it's not working for some reason

[tough fjord]

@green mason whats up?

[green mason]

fine Alhamdulillah, guessed the answer without running the instance

[tough fjord]

unable to launch instances?

[green mason]

yes

[tough fjord]

let me check with the team

[green mason]

ok, thanks

anyone else had problems on the LFI module?
@rustic sage i haven't solved the module, but did you provide the cmd param?

[rustic sage]

I just used the command in the first image

didn't define anything before

other website show the same command

but it just gives error messages in the log file

[green mason]

so isn't it obvious?

system function is not taking any param in your case

you should add cmd parameter into url

[rustic sage]

but I'm providing a param

I'm using user agent

[green mason]

I just used the command in the first image
didn't define anything before
@rustic sage it is what you have said 😄

you are not providing the cmd param

[rustic sage]

[tough fjord]

you create the webshell but never feed it a command

[green mason]

need to be like that

[rustic sage]

AAAAAAAAAH

[tough fjord]

Getting into spoiler territory

[green mason]

i wasn't know that

[rustic sage]

yeah sorry

[green mason]

removed

[tough fjord]

no problem dude

[rustic sage]

I didnt see that the param was provided in the url

[green mason]

if you don't know about web requests i advice you to have a look on it.

[tough fjord]

it was only us who saw it

there is a web requests module as well which covers things like that

[rustic sage]

yeah I did that

looks like I'll do it again

lol

I just didn't understand that the injected php code interacts with the url

thought it would be standalone

my bad

[tough fjord]

yeah. Have a read up about log poisoning attacks

[rustic sage]

yeah

I'll look into it

thanks a lot guys

I understand now that I can pass parameters with a get request to the php script

but I feel like it's thought around the corner isn't it? I can just put whatever I need directly into the php code without using a variable

[tough fjord]

if you created suitable php code

[rustic sage]

it's just a question of "do I want to inject php code again and again or use the paramter"

[tough fjord]

well the code will persist - it has been added to the log file you are calling

so you only need to enter it once. Then you can just keep using the param in future requests for whatever you want to do

[rustic sage]

Yeah that's true. Probably that way is more "silent"

[tough fjord]

depends on who is monitoring

[past scaffold]

hello can anyone give me a hint for the last quiz of LFI module. I tried everything and i stucked a little.

[heavy inlet]

@past scaffold dm

[green mason]

wow, learning process was hard than i thought

[hushed grove]

wow, learning process was hard than i thought
@green mason i think the same, but without solid bases don’t will be successful i think

Im soo noob in it. But i want to learn and progress correctly

[next cedar]

Sooo I have the flag for Web Requests POST, but it's not being accepted as the proper flag. Any tips?

The page literally reads as "The flag is *******************"

[next cedar]

FFS

The last character is not part of the flag.....

[tough fjord]

Isnt the last character a punctuation mark?

[arctic linden]

I'm looking at file inclusion, and it tells me "When following along, swap the IP address and port in the URL to match your spawned Docker instance." and I don't see where the IP and post are to connect to the target web page.
Any suggestions?

[unborn pond]

i don't understand the question for Learning Progress .-.

[plucky nimbus]

can someone pm me i need help with web requests

[arctic linden]

I got my issue figured

[next cedar]

Isnt the last character a punctuation mark?
@tough fjord Yeah, but I had been working for about 11 hours prior to getting on and had a massive brain fart on that one.

[green mason]

i don't understand the question for Learning Progress .-.
@unborn pond easy game easy challenge

think simple inshaAllah

[unborn pond]

@green mason i legit don't understand what it wants from me. it says what's the difference i put in the differnece but still wrong

[green mason]

😄

the difference

only the difference

find the difference own yourself

i am sure 7 year old people can do that 😄

[unborn pond]

nice

[green mason]

it is a hint

not a humiliation

[unborn pond]

just more confused.. xD

[green mason]

you don't need text @unborn pond

is it enough now?

[unborn pond]

i know :p

[unborn pond]

nah still can't

[tough fjord]

#774038216239349820 message

@unborn pond

[tulip minnow]

Hi guys, I'm new here and noob!. I've been trying the "Web Requests" module and I'm stuck to "POST Method" section. I tried Burb and also curl, getting the cookies but none is accepted as correct answer. BTW, I have finished the next sections and this is the only left! Any hints please? Thanks in advance!

[tough fjord]

Have you examined the cookie?

[tulip minnow]

For some reason I'm not getting a "PHPSESSID" but "auth". Is this the problem?

[tough fjord]

That doesnt sound right

Sure you are going against the right target

[tulip minnow]

Yes, target as shown above the Questions

[tame obsidian]

same problem with the POST

and the hint is very poor

what is the problem with the flag?

[grim ice]

hello, i just finished the learning progress path in HTB Academy but there is a problem with the last question i can't find the answer, can any one help me here?

[tough fjord]

Look at the maths sum

Its the literal difference between them

[grim ice]

yeah i know but i can't know what should the answer look like

[tough fjord]

37.6 or whatever it is. Minus 1

[past scaffold]

i am stucked a little in LFI last quiz any help will be appreciated.

[tulip minnow]

I just want to know if anyone completed the "POST Methods" section in "Web Requests" module and I will keep trying....

[cobalt nest]

I just want to know if anyone completed the "POST Methods" section in "Web Requests" module and I will keep trying....
@tulip minnow yeah mate , I completed it

Took me a while , and I was over complicating it a lot as-well!

[tough fjord]

@tulip minnow i completed it a few days ago

[rustic sage]

don't you need to do something with the ||cookies|| on POST? any hints?

[cobalt nest]

Yeah , maby find out what the cookie translates to ?

[rustic sage]

i can change it...

but it doesn't matter much

it just || says something different||

[tulip minnow]

Thank you guys.. I will keep trying

[tame obsidian]

@tulip minnow so the POST work?

[faint geyser]

Broski

@tulip minnow I have the same problem

Idk how to solve it wth

[unkempt geyser]

so whats the point of the academy if the lesson doesn't actually teach you how to do the practical, is this once again one of those, oh yeah you have to figure it out by yourself thats how you learn things? cant see people paying for that

the first fundamental lesson goes on about session cookies, but then the server doesn't send one, no doubt you have to do something to decode / encode the cookie that is sent and change the payload, if thats the case why doesn't the lesson talk about that?

[faint geyser]

Nvm

@tulip minnow I got it @rustic sage @tough fjord It isn't about a number I don't think

I didn't understand what it was asking...

Oh wait nvm @tough fjord

@tulip minnow Here is a hint: You see that the page says welcome guest_"etc"! right. So you basically have to get it to say welcome admin! ||The cookie plays a role in changing the text. The current guest:guest cookie is encrypted in some way as to encrypt the guest_etc part of the welcome guest_etc! text into the cookie...||

[rustic sage]

even if i change it to say admin nothing changes

[faint geyser]

It does

[faint geyser]

Yea you have to use burp

Try using repeater with the new cookie

[rustic sage]

i used zap ...

[faint geyser]

And I think that may be an unnecessary space

Can you get it without the space? ||Im not sure maybe you did something wrong with the encryption and decryption part...||

[unkempt geyser]

@faint geyser how are you supposed to know what to encode the payload part of the cookie to? this is what im saying they dont discuss any of this in the lesson, you can change the username, but how do you know what to change the code to?

[faint geyser]

I knew this from before, but in burp there is a section called decoder where you can decode and encode text...

Another hint (spoiler, seriously don't look without trying:)): ||try to figure out what kind of encryption is being used to convert the guest_etc text on the page to the cookie... Then use this encryption type to encrypt the word admin.||

[unkempt geyser]

yeah pressing smart decode does nothing, i normally use cyber chef, but its not getting anything other than getting the suername from it

[rustic sage]

does it only work on burp?

[faint geyser]

Ok then try this. Add the cookie into decoder and figure out which decrypt type changes the cookie into the text on the page the "guest_etc" text.

@rustic sage I doubt it, but burp has this functionality

[rustic sage]

i mean the intercept part

after you got the cookie

[faint geyser]

No use repeater to send a get request with the cookie

You can also use curl

Basically you are sending a get request with the new cookie

[unkempt geyser]

@faint geyser i already know how its encoded, what im asying is changing it to say admin_whatever on the page doesn't get me a flag

[rustic sage]

i give up, this is broken, not working with curl or zap or browser

[unkempt geyser]

Welcome, admin_||917cec9798d1030d3d3c7.!||

obviously you can change any of that to whatever you want, so im not sure where the flag is

[faint geyser]

No dude

@rustic sage relax youll get it

[rustic sage]

i tried, admin, Admin, ADMIN..nothing

[unkempt geyser]

can someone just say if once you get it right there is a thing that says the flag is [whatever] and not just you have to stick whatever cookie you come up with in the submit box?

[gentle salmon]

you probably have a newline character in ur code

@rustic sage

[rustic sage]

ffs it was missing the final char, thought it was useless

[unkempt geyser]

ok got it

[faint geyser]

Did u get it @unkempt geyser ?

[unkempt geyser]

really if they want people to pay for this they really need to teach you how to do the practicals in the lesson. If you had never done anything like this before there is zero chance you would get past these early lessons

@faint geyser yeah

[faint geyser]

They did state that the cookies are encoded in base64 for some login forms which was kind of a clue

What was the problem @unkempt geyser ?

[unkempt geyser]

without giving it away i was having problems with the payload after the username

[faint geyser]

Oh

[unkempt geyser]

i was overthinking it

i was trying to figure how it was encoded....

[tame obsidian]

So it's just base64 decode then change guest for admin encode base64 and resend?

[rustic sage]

|| yes ||

[faint geyser]

Im confused on the next section

The put and delete methods one

I generate a request with a custom file I created but every time I get a 500 internal server error

nvm

got it lol

[summer vigil]

in the PUT and Delete methods section I've created the file and requested it several times but don't see a flag. I tried it with curl and burp. any suggestions?

[uncut flame]

@summer vigil ||try creating a new file named flag1.php instead of flag.php. using GET for flag.php ended up returning nothing for me.||

[trim bane]

Can anyone help with the windows fundamentals please? I'm trying to find the non-standard update service running? I've looked at Task Manager process & services and Get-Service in powershell and have a huge list of services and no idea which one the non-standard one is! Any help would be appreciated

[quasi bloom]

anyone can help with web request get methode?
i just try it with multiple param value "&" but doesnt still show anything

[tough fjord]

The values you give to num1 and num2 have to add up to 1337

[spare crane]

anyone able to help me with the post req portion got a question

[quasi bloom]

The values you give to num1 and num2 have to add up to 1337
@tough fjord like this?

[tulip minnow]

anyone can help with web request get methode?
i just try it with multiple param value "&" but doesnt still show anything
@quasi bloom consider putting the parameters in the URL

@tough fjord like this?
@quasi bloom It doesn't say they are equal...

[tough fjord]

@quasi bloom why are you using port_code? It tells you to use num1 and num2 as params

[quasi bloom]

oohh i get it ! thank u @tough fjord @tulip minnow

[spare crane]

need some help with post req plz dm

why am i not getting cookie anymore for this post shit

asdfklashjdlfahsdfjshdf

[tawdry ermine]

How do I submit the flag correct when it says "key=DECODED_KEY"?
@cobalt trench im stuck here as well, getting the same encoded string back even with that. did you solve this?

[spare crane]

im hjaving an actualy problem with the post req box can a mod pm me

[cobalt trench]

@cobalt trench im stuck here as well, getting the same encoded string back even with that. did you solve this?
@tawdry ermine I've done it

[spare crane]

im not getting a phpsessionid im gettingh auth- is that normal?

disregard

i am the dumb

figuresd it out

[spare crane]

Havin some issues with the cat command on the put file if anyone can assist.

[pseudo basin]

Hey I've been doing the Windows Fundementals course rn and I'm taking a lot of notes, however there is so much information there that there is no possible way for me to remember everything... What are some of the most important things from there that I should know? I will be studying everything there anyway, but I want to know what I should be paying most of my attention to

It is a little bit overwhelming I have to say...

[pseudo basin]

Is there anything specific that is good to remember?

that is used a lot or is very important to know

[trim frost]

I think the most important thing is to practice and powershell is good to know

[tough fjord]

Knowing the fundamentals of Windows is important

Its going to underpin anything else you do with Windows

[vocal lake]

I am stuck on the POST request exercise, trying to login with the admin credentials, but it keeps telling me that the credentials are wrong.. I don't get it 🤔

[tough fjord]

Login as guest/guest

Then escalate to admin using what they hint at

[vocal lake]

Oh, ok! So I am not supposed to try to login directly via admin:password credentials? I guess I didn't understand the exercise

[tough fjord]

It does say login and escalate to admin and gives you the guest credentials iirc

Try not to overthink this bit. 🙂

[vocal lake]

True, but at the very beginning it also says to try and login with admin credentials, and I couldn't.. That's why I got confused :/

[tough fjord]

Ah i think that bit is referring to a different target than the exercise one

[vocal lake]

Try not to overthink this bit. 🙂
@tough fjord That's always been my weakness, I tend to overthink whenever I am not drunk haha

[tough fjord]

Hahaha

[vocal lake]

I finally managed, but it honestly wasn't as easy to understand what the exercise wanted me to achieve.. I imagined that "getting to admin" meant something completely different.. Oh well..

Gin always helps I guess 😄

[vocal lake]

The PUT and DELETE was easier, yet for some reason I could not delete the file after creating it.. Not sure why :/

[spare crane]

I had a hard time deleting also
Just reset box

[rustic sage]

Do you have to use their window terminal to complete the modules, can you use your own machine?

[earnest rover]

Hi all, for the file inclusion / Directory traversal, it says:

tart Burp Suite, intercept a request to the page, and send it to Repeater. 

However, I've never used burp suite. Is there some tutorial on how to achieve this?

[rustic sage]

start burp

make sure the browser will fo thru burp

via 127.0.0.1:8080

set intercept on

load the page so burp will intercept it

right click that request that burp intercepted and click send to repeater

[earnest rover]

make sure the browser will fo thru burp
via 127.0.0.1:8080

Do you mean that I set the target in the Repeatert ab to 127.0.0.1:8080, and not the IP of the target machine?

[rustic sage]

no

https://portswigger.net/burp/documentation/desktop/getting-started/proxy-setup/browser

[earnest rover]

this is correct, no?

I have my intercept button on, however when I navigate to the target IP with a logfile parameter in the URL, the intercept tab shows nothing. Can anyone help me further?

I'm pretty much stuck here, and I can't figure out why burp isn't intercepting the website when I refresh the page, or when I navigate towards it.

Anyone has an idea what I'm doing wrong, and how to correct it?

[sturdy wasp]

Try:
Click >> Options >> set Title "Burp" >> Save

Burp

then, navigate to the following address: http://localhost:8080 and install the CA Certificate.
move over to the settings menu in Firefox. Search for 'Certificates' in the search bar >> view certificates >> import

[faint geyser]

How can I get more cubes?
Is there any way to get more without paying?

[tough fjord]

@earnest rover the web requests module gives a quick overview of burpsuite

[vocal lake]

How can I get more cubes?
Is there any way to get more without paying?
@faint geyser As far as I understood it, the only other way to get cubes (other than completing modules) is to pay.. It's not much money, and I'd say it's worth it

[Web Requests - curl]
Gang, quick check, am I supposed to actually use
"curl http://inlanefreight.com"
Or am I supposed to spin up one of the previous target and use that IP address instead? Because using the URL with curl results in this for me, as i t goes out on internet to resolve the domain, while in the module it resolves it to a local IP address..

[tough fjord]

@vocal lake the exercises have you spin up a target to complete them against

[vocal lake]

Not in the curl one, cause there is no "exercise" per se..
But since I want to practice everything I'm learning, I am spinning up previous targets to go along with the curl module 🙂

[tough fjord]

Curl is just web requests module isnt it?

[cyan iris]

suggestion to improve the wording of the following question in Web Requests:

Original:

What is the method used while intercepting the request? (case-sensitive)

Proposed:

What is the HTTP method used while intercepting the request? (case-sensitive)

without specifying HTTP, the question is too vague - one can try all kinds of things such as MITM, HTTP downgrade, etc etc

[tough fjord]

Thanks CawCaw. Will pass it on

[green mason]

{
Module: "Windows Fundemantals",
Content: "winlogon.exe": "Responsible for handling the secure attention sequence, loading a user profile on logon, and locking the computer when a screensaver is running.",
Question: "What does that mean 'locking the computer when a screensaver is running'?"
}

[earnest rover]

Hi, I'm doing the web fundamentals module, and the example says that the burp intercept should look like this:

But mine looks like this:

are there some parameters which I've missed? I've done everything according to the walkthrough, also put all settings on according to the walkthrough, but I can't get the respondse as in the examples of the module.

[green mason]

you are getting only requests but not the responses

[earnest rover]

I've put the server responses on in the options.

[green mason]

hmm

[green mason]

so you can see that content type should be text to intercept the response

text/html

could work

[earnest rover]

if I edit the condition to text/html it doesn't change the intercept tab when I foreward the request.

But this means I also can't answer the question because I can't see/get a server response to see which version of apache my target is running on.

So I'm pretty much stuck at this point.

[green mason]

you can send your request to repeater

then you can see the response in there @earnest rover

[earnest rover]

how do I send my request to the repeater?

[green mason]

action->send to repeater

or just copy the request and paste it to repeater

[earnest rover]

ah, sweet. I can indeed see the apache version. Thanks, atleast I can continue.

However, this doens't change the fact that I didn't actually perform the task as intended. Do you per chance know what I did wrong? Settings misconfig?

[green mason]

if you did change the content type to text/html and the response you get includes content type as text/html, i don't know what else you can do

but i have solved 72 labs using burp and i have never felt a need to get the response in intercept page

it is bad to get the response every time

when i need it i send it to repeater

that's all inshaAllah

[earnest rover]

Hm, fair enough. I just want to do it correctly though, for the learning sake. But thanks for the feedback.

[green mason]

yeah, i understand you, np 😄

yw

[green mason]

{
Module: "Windows Fundemantals",
Content: "winlogon.exe": "Responsible for handling the secure attention sequence, loading a user profile on logon, and locking the computer when a screensaver is running.",
Question: "What does that mean 'locking the computer when a screensaver is running'?"
}

@green mason any idea?

[blissful verge]

@green mason https://docs.microsoft.com/en-us/windows/win32/secauthn/responsibilities-of-winlogon

[green mason]

could i ask something about a powershell command? @blissful verge

[blissful verge]

Ya, shoot me a dm

[restive quest]

Dont know if its a problem only to me, but in the windows fundamentals course, the windows machine taskbar is low enough to be not visible

and i change it to the right sight so that i can see it

if its a problem for other people too maybe there must be a fix for this

[wild beacon]

Hi All.

I'm currently stuck on Web Requests, I don;t seem to have a connection to the target machine, keep getting failed to connect error on firefox.

Burp is enabled on firefox and I've completed the first part of intercept and get the request to display in Burp. When I click on Forward thats when I get the failed to connecto to 206.189.25.23:30147 message. Can anyone help? Thanks

[rustic sage]

Is intercept on in Burp?

[wild beacon]

Yep, Intercept enabled in proxy options with the firefox extension also enabled.

[rustic sage]

Refreshed the browser?

[wild beacon]

I get the first part of the intercept, code shows in the Raw display. When I click on Forward to forward the request to the target I get the error message.

[rustic sage]

What part are you on?

[wild beacon]

Yep, refreshed the browser, port 30147.

[rustic sage]

Send a GET request to flag.php with two parameters num1 and num2 such that their sum is 1337?

You can DM if you'll like so we're not flooding the chat channel.

[rustic sage]

I'm really struggling with "Create a file named "flag.php" with contents "<?=cat /flag.txt;?>" and request it to get the flag." on the Web Requests module, anyone free to help me out?

[blissful verge]

@rustic sage feel free to DM me

[cobalt nest]

can someone who has completed the " Windows Fundamentals" give me a DM please 😄

[eager crescent]

Has anyone here completed the post web requests challenge? quick question

[runic summit]

I have, feel free to dm

[eager crescent]

cool ty

[cobalt nest]

anyone help with windows fundamentals mod ? surely someone ?

[green mason]

Which section?

[cobalt nest]

"windows Security"

[green mason]

Havent done that one yet

[cobalt nest]

lol, yeah I thought this module was plain sailing till i got to this part

[green mason]

@green mason https://docs.microsoft.com/en-us/windows/win32/secauthn/responsibilities-of-winlogon
@blissful verge thanks

[wild beacon]

Hi. I'm trying to follow along with the Web Requests - GET Method. I've spawned the target machine and opened up FireFox on My Workstation. When I type http://inlanefreight.com/ it redirects the browser to https://inlanefreight.com/ and doesn't open the authentication page.

This is before I've enabled Burp to capture traffic, I can't see what I'm doing wrong on something so simple 🙂

[drifting knoll]

@wild beacon because you have to navigate to your spawned target

the inlanefreight.com is just an example in this case

[wild beacon]

Ok, thanks.

[earnest rover]

Hi, I've a question regarding the web requests: I've managed to get to website of the dashboard.php, with the admin panel. However, I'm not sure what the answer to the question should be? As in, the question is:

Login with the credentials guest/guest and try to get to admin. 

Which I think I've done? I assume some answer in the form of "Goodjob! flag is : XXXXXXX" should be shown but isn't.
Could anyone point out where I am wrong?

[tough fjord]

if you've escalated to admin it will spit out a flag on the page similar to what you say

[earnest rover]

Yeah, I figured it out. Was a bit of a puzzle, but I got it eventually.

[tough fjord]

good stuff

[woven charm]

I have same problem of CroqDog

I have escalated to admin and i get the flag but isn't correct.. what i am wrong?

[icy prism]

Same problem here, I did the same thing and I took everything. The problem is that I don't understand which is the answer. Any help?

[woven charm]

Solved!

[wild beacon]

Hi, it's a little late I know, but is there anyone who can offer some hints for Web Requests - POST Method? I'm getting all the way through the walkthrough to the end and get the welcome message on the admin panel but the answer detail isn't accepted.

One thing I did note is the cookie for me was set as Auth= instead of PHPSESSID= don;t know if this should make a difference?

[icy prism]

I've just solved: just follow literally what the question is telling you

[wild beacon]

Ok, sounds like I may be over thinking things. Brain is burnt out so I'm going to sleep on it and try again tomorrow, I know it's possible 🙂

[valid whale]

i got the same issue

except rereading the question 20 times didnt work

"get to admin" what?

[valid whale]

i still dont get it

[summer vigil]

In Web Requests module POST and DELETE methods section I've been trying to get this last flag to complete the module but nothing is working for me. I create a file, put the contents in it and upload it, and then request it. The only thing I ever get back is cat /flag.txt. I get the same with curl and burp. I got a suggestion a couple days ago that I tried with no luck. Just curious if anyone else had the same issue? Any tips? Thanks for any help.

[cyan iris]

that suggests that the cat command is not being run on the system

did you enclose it apostophes (') instead of backticks (`)?

aside: typo in Advanced Obfuscation: **remanence ** -> remnants

^ two occurrences on the page

the text in Rot13 Decode is incomplete:

There isn't a specific command to

[valid whale]

In Web Requests module POST and DELETE methods section I've been trying to get this last flag to complete the module but nothing is working for me. I create a file, put the contents in it and upload it, and then request it. The only thing I ever get back is cat /flag.txt. I get the same with curl and burp. I got a suggestion a couple days ago that I tried with no luck. Just curious if anyone else had the same issue? Any tips? Thanks for any help.
@summer vigil same issue

replaced the apostrophes with backticks and same thing

[summer vigil]

Ah, wow, I can't believe I missed that. Thank you!

[valid whale]

did it work for you?

[summer vigil]

It did

[valid whale]

XD its still not working for me

nvm

i made flag1.php

saw a hint from earlier and the new doc worked

[summer vigil]

Nice. Glad it worked.

[valid whale]

🙂

[cyan iris]

🙂

[valid whale]

ty cawcaw

[unborn pond]

i need help with POST Method for the guest:guest

[unborn pond]

nvm i did it

[shy flower]

I keep getting stuck in the web request POST method questions. I did everything as explained in the section but instead of PHPSESSID= <cookie> in the Set-cookie header, it said Auth= <cookie>. Does this mean anything? because I tried using that cookie as the answer too, but it turned out to be wrong. So someone please help me out

[valid whale]

You probably noticed ||The cookie changes each time||

You can dm me if you need to @shy flower

[paper hull]

im having trouble with the JavaScript Deobfuscation module

ive decode the message but the post request doesnt work

[hot swallow]

I have tried everything I can think of to get the POST method section of web requests to work. I finished the rest of the module and have come back several times. Would someone please DM and help me out?

[tough fjord]

whats up?

[paper hull]

im at the step when you have to decode the string that you get sent in the post request and post it back i decode it but it wont post back

[valid whale]

I have tried everything I can think of to get the POST method section of web requests to work. I finished the rest of the module and have come back several times. Would someone please DM and help me out?
@hot swallow i can DM

[cyan iris]

stuck on the following question on Windows Fundamentals:

Use WMI to find the serial number of the system.

got the serial || VMware-42 39 99 [...]||, but answer doesn't seem to be accepted

what am i missing?

[upper lake]

even though it was discussed several times, I also have some issues with the POST guest:guest login thing. I also got the auth cookie thing and I understand what it is, I also tried to change it and convert it back but still have not the results I'm looking for. Maybe someone has another hint for me? Feel free to DM me

[upper lake]

Nevermind, I found it -.-

[vocal fable]

Lol I invested way too much time on POST

[green mason]

really wondering how much hard the web requests module is

%68 of the questions are related to web

[valid whale]

its not hard its just BS imo

not as direct as it should be

takes guessing syntax

most ppl asking for hints already understand how to do it but dont know what to type

[tough fjord]

I didnt think there was any guessing there

It was pretty straightforward

[valid whale]

The module assumes you know what youre looking at

And also assumes you know what to do with it

Should've had a section before the last flag to explain things more

[tough fjord]

But it explains those things

[green mason]

lol, yeah I thought this module was plain sailing till i got to this part
@cobalt nest idk that part also seems easy(security one)

[glass comet]

even though it was discussed several times, I also have some issues with the POST guest:guest login thing. I also got the auth cookie thing and I understand what it is, I also tried to change it and convert it back but still have not the results I'm looking for. Maybe someone has another hint for me? Feel free to DM me
@upper lake Yeah I've been smashing my head on this one for a little bit.

[earnest rover]

Hi all, Im doing the windows fundamentals and I need to find a non-standard update service. Do I need to find this using the task manager, or how should I approach this. I've read through the module, and I assume I need to use Process Explorer, but I can't download that on my remote desktop. Could anyone push me in the right direction for this one?

[green mason]

@earnest rover how can you detect an update service?

[earnest rover]

You mean in the task manager, or in general?

[green mason]

in general

[earnest rover]

In the task manger under processes? I can't find how to find update service in specific

The hint says to use powershell, so I assume I need to use the command Get-Service, and find the non-standard update services from that.

I've tried using powershell command Get-Service, but I can't get any matches.

[valid whale]

findstr can be used in place of grep in batch if you pipe it into the command. i just found that out

[primal canyon]

Anyone who can give a hint with "What non-standard application is running under the current user ? (The answer is case sensitive)." under the Windows Security segment under the Windows Fundamentals module?

[valid whale]

you can run a search for running services in powershell and use findstr to narrow. thats not how i did it but i did it the "wrong" way 👀

[earnest rover]

Where can I find an example of how findstr works greping the outcome of Get-Service with -like isn't working for me. So I'm kinda stuck.

[valid whale]

by nonstandard it just means one that isnt a default microsoft service

i referenced the module screenshot

it shows you how to list the running services

[earnest rover]

by nonstandard it just means one that isnt a default microsoft service

how can you identify this from Get-Services?

[valid whale]

i think you just have to be able to tell whats not from microsoft

and is also a running update service

[earnest rover]

Yes but for example:
how can I know if this is from microsoft or not?

[valid whale]

well its not an update service

[earnest rover]

where can I see that>?

[valid whale]

in the name...

i used task manager

[earnest rover]

So you need to search for names which contain update?

[valid whale]

thats what i did

[earnest rover]

Alright

[primal canyon]

@valid whale thanks

[valid whale]

yw sorry i didnt give straight answers about powershell i didnt even look at hint or use it so i dont know the "correct" method

[earnest rover]

It's still not working for me. Powershell is returning 0 results., and shutting down the RDP when I try to enter a query.

[valid whale]

copy and paste the command from the screenshot

then you can pipe after that

[earnest rover]

The command from the screenshot shows no service with update or anyhting related.

[valid whale]

What? Idk how thats possible

[earnest rover]

I don't know?

Just to be clear, you mean this command: Get-Service | ? {$_.Status -eq "Running"} | select -First 2 |fl

[valid whale]

even Get-Service

yes thats the one

[earnest rover]

yes when I run that I get two results, and neither contain the name update.

in DisplayName or Name

[valid whale]

the commands should display similar results (the exact same results for the module)

[earnest rover]

yes, I indeed get a similar list.

[valid whale]

you just have to sift through that list and i recommend piping to findstr string

[earnest rover]

but if I use -like "string" I get 0 hits.

[valid whale]

i got 3

when i piped to ||findstr Update||

maybe you didnt capitalize it

[earnest rover]

I also get 3 hits, but still get incorrect answer.

[valid whale]

you need to put in the whole exe i believe not just the name

add the .exe afterwards

[earnest rover]

yeah it's taking a while because my RDP keeps throwing me out after I run a command in powershel

[valid whale]

thats weird

[earnest rover]

add the .exe afterwards

God im such an idiot

thanks so much for your patience.

[valid whale]

yw we all been there

its the burnout

||i just scrolled down task manager when i did it||

saw it and was like "the heck is this?"

[earnest rover]

I had no idea how to identify which process wasn't a windows one. and I figured it wasn't very efficient to list all the services..

or just bruteforce all possible services as answers.

[valid whale]

practice helps a lot

i use task manager like daily for closing tasks. Call of duty world at war never closes for me properly

ctrl + shift + esc is the hotkey i use

[shut remnant]

hi there

somebody can help me with web requests

I'm doing the Post Method section

and I can not pass it

[rustic sage]

@shut remnant What is the problem you are having with it?

[glass comet]

@shut remnant I've been working at it off and on as well today.

[shut remnant]

is that i track the cookie

[rustic sage]

I'll go and do that module now and see if I can pass and help dude, let me know if you get it in the mean time 👍

[shut remnant]

i've got the post section boys

(hint:remember the javascript obfuscation module)

[glass comet]

Well, I'll have to do that one first then.

[rustic sage]

Nice @shut remnant good work

[gray ginkgo]

I give up on the POST module... It's probably staring me in the face but can't process at this time 🙂

[brazen hinge]

Why don't I have permission to talk in the easy module?

Oh I guess I have to verify first

[rustic sage]

who wants to help me? i am in the fundamental modules and need the answer of the Learning Process... i only want to know is it 1 word or is it complete sentences because i tried both bot it wont work. i look on the internet for words and differences both everything i tried was not good. i even tried the difference between 1 and 2 😂 just to think out of the box so who can help me a bit

[earnest rover]

See it as a mathematical problem.

[drifting knoll]

@rustic sage there is hint

[rustic sage]

i saw the hint but my math is so bad 😂

i will look for the math on the internet o wait you woulkd not meen its 37 right hahha

[drifting knoll]

37.7 - 1.00 = ?

[rustic sage]

i have it hahaha

i noticed thanks

i tried 37 and 36 but not the point .7 after it haha so never make that mistake again 😂

[tough fjord]

you are not the first, and wont be the last

[brazen hinge]

I'm burnt out today

I managed to join when there aren't any real beginner boxes ofc

When do they cycle

[tough fjord]

New box every week

Difficulty varies. If you want easy boxes do starting point or get vip and do the easy retired ones

[earnest rover]

Hi all, I know Ive asked a smiliar question yesterday. But im trying it again.

I'm in the windows fundamentals module, and I again have to identify a non-standard application that is running. However, I have no idea how to identify a non standard application. This time there is no hint either. Could someone point me in the right direction?

[unborn pond]

not done the module but i think it means any 3rd party services running on the system that a user has installed

[earnest rover]

Yeah, I figured it out. I'm just not that familiar with which applications are user installed and which are not on Windows.

Thanks for the help though!

[harsh palm]

Hello Guys...
I'm stuck in the POST section of the Web Request Module.
When I intercept the login page request with wrong credentials and send it to Repeater I always receive a 200 Ok code with a Login Failed message. I never get the 302 Found code. Besides that there is no PHPSESSID cookie, only the auth one.
I do not know what do do anymore.
Could somebody help me please?

https://i.ibb.co/r26BVdz/burp.png

[dapper belfry]

it doesn't always have to be PHPSESSID

that was an example

in this case it's Auth

[harsh palm]

it doesn't always have to be PHPSESSID
@dapper belfry Thanks. But how about the 302 Found code?

[dapper belfry]

that's not necessary as well

different applications handle it differently

what if you use correct credentials?

[harsh palm]

what if you use correct credentials?
@dapper belfry I can reach the dashboard page only using guest/guest credentials

[earnest rover]

Hi, I'm doing the ffuf course, and it tells met go to academy.htb:PORT, but how do I find the port?

the port of the target only?

when I use the entire IP of the target, I get 0 results. Could someone point me in the right direction?

[tough fjord]

have you read the earlier course content?

where it explains how to get domains to resolve locally in /etc/hosts?

[earnest rover]

yes

[tough fjord]

and the port will be the port from the target instance you spin up

you won't get any results from just the IP because of virtual hosting

it needs the domain, which is why you need to set it up as explained in the module content

[earnest rover]

I'm awere of that, but when I run the example in the course with the :PORT changed with the port of the target, I don't get any hits.

[earnest rover]

Is it correct that I get a major list of VHosts?

[tough fjord]

are you configuring your fuzz correctly?

[earnest rover]

I've absolutely no idea. I'm very confused about what I've done correct and wrong. I get results resulting from boom to jasper. I've added my target to my etc host, and i've changed it with the port. Yet, no flag seems to work when I try to submit it.

[tough fjord]

look back over the content and see how they do subdomain enumeration

make sure you are doing the same and updating the relevant bits

[earnest rover]

I've done it all, three times I believe. yet still i get this major list of possible hits.

I've no idea whatim doing wrong.

I've added every possible combination of IP and port to my host file.

could someone help me?

[unborn pond]

in your host file just add ip and domain with out the schema

not port

ip domain1 domain2 ect

[earnest rover]

yeah so I do:
sudo sh -c 'echo "143.110.169 admin.academy.htb" >> /etc/hosts'

and then when I browse to:
admin.academy.htb:30468, it can't be located.

[unborn pond]

then visit admin.academy.htb:PORT

make sure the ip in your host is same as the target ip

[earnest rover]

I have it all, ip in host file. yet still the ffuf giving 0 results when I use the correct port.

[unborn pond]

sudo sh -c 'echo "143.110.169 admin.academy.htb academy.htb" >> /etc/hosts'

[earnest rover]

and when I use the same code as in the example, I get a gigantic list of results.

[pliant pewter]

can someone help me with WINDOWS FUNDAMENTALS?

[worldly musk]

👀

[pliant pewter]

huh?

[worldly musk]

No never mind i was trying something

[pliant pewter]

k

[blissful verge]

hey everyone, we've added a short module called File Transfers it can be seen as a reference guide and should be extremely useful if you are having trouble transferring files to/from Pwnbox or target VMs. loads of handy tips throughout for all sorts of file transfer methods

[earnest rover]

I've fixed my issue. I was a major idiot and overlooked a detail. Thanks to Sneaky.

[opal blaze]

hi, i have a problem in Web Requests module, particularly in the first task Request and Response.
Burp doesnt pick up my target in Proxy list. instead the thing is clogged with some "detectportal.firefox.com" thing.

[tough fjord]

forward it

[dapper belfry]

click on forward

[opal blaze]

interesting, thanks

[tough fjord]

it's just holding all requests that are made until you deal with them whilst intercept is on

[summer vigil]

In Windows fundamentals how do I find the NT version? I tried system settings in the GUI, and a bunch of powershell commands that give me tons of info for system info and whatnot, but nothing is correct when I submit it. Coulda swore this would be pretty straightforward, but I'm stumped.

[shut remnant]

(check the table of the windows versions)

[summer vigil]

Yeah that was the first place I looked.. I got it now. I was trying to submit too much info. Smh...

[shut remnant]

🙂

good

[opal blaze]

POST Method exercise. Stucked on the "Login with the credentials guest / guest and try to get to admin."
Hint says "cookies" but i still have no clue 😄 . Any tips?

[wild beacon]

Hi, is anyone available for a dm. I'm on Web Requests - POST Method. Just want to run through my process, it looks like I'm there yet the answer I give isn't accepted. Thanks

[green mason]

@opal blaze focus on auth cookie

@wild beacon you can dm

[opal blaze]

So i tried to set aut cookie = admin

it worked but

what then

[green mason]

understand how the cookie encoded and decoded

[opal blaze]

damn

so close xD

thanks

[earnest rover]

Hi, i'm at the last part of the ffuf module, where the hint says I need to replace the port of my target with the string 'PORT' but this seems highly unlikely to me.

Furthermore, when I do so recursion gives no results.Am I seeing something wrong here?

[green mason]

wait me until i arrive there 😄

[earnest rover]

I know the sub-directories, and the files which I have correctly answers before.

[green mason]

one section remained

[earnest rover]

alright.

[green mason]

inshaAllah

[green mason]

@earnest rover last part

[earnest rover]

hm, i keep finding the hint hard to believe, that you have to replace the port of your targed with "PORT".. yet I can't find hits with recursion to be fair.

[sudden trail]

Hi! I've been trying to work out the GET request in the WEB REQUESTS module. I understand that I have to use something like http://flag.php?num1=X&num2=Y Do I just use any two number for X and Y to make 1337? Or is that not what I'm doing wrong?

[green mason]

you are right

but dont forget to add the ip of the website into url

[earnest rover]

you mean subdomain?

or target?

[green mason]

it was pointing to bearsurf

[earnest rover]

oh sorry

[sudden trail]

@green mason The IP I should use is the one I spawned? Right?

[green mason]

yes

@earnest rover which questions are you trying to solve?

the second one?

[earnest rover]

3rd one

[green mason]

just arrived there

let me check

[earnest rover]

look at the hint

[green mason]

Alhamdulillah

ok

hmm

interesting

[earnest rover]

I've tried all permutations

[green mason]

oh ok

by saying PORT it means when sending the answer

nothing else

you know every instance have different answer

to make it static they give it a name of PORT

[earnest rover]

yes I know

oh damn

fuck

stupid

lol

[sudden trail]

I've tried several versions of this http://<my spawned IP and portNumber>/flag.php/?num1=1330&num2=2 Can't seem to get it right.
Side note. On Slack you can reply to messages in a thread. Can you do that on here? I feel like I'm interrupting a conversation.

[earnest rover]

you can

[green mason]

it is 1332

not 1337

and also why to put / before ?

flag.php? would be better i think

[sudden trail]

This is my question. Send a GET request to flag.php with two parameters num1 and num2 such that their sum is 1337.

[green mason]

so they are not summing up to 1337

just check your parameters

[sudden trail]

I've removed the / before the ?
Sorry the last number is 7 in my answer not sure how I managed to change it to two.

[earnest rover]

with ffuf recursion do you always have to give a depth, or can you leave it out?

that was not ment as a quote, btw.

[green mason]

dont know but 1 is fin

e

if it would not be then we can go deeper

how can we filter status

do you know?

[earnest rover]

-fs

[green mason]

it is for size ?

not for status afaik

[earnest rover]

fair

btw, im still on the 3d pard. each command takes approx 5 min, is that normal?

[green mason]

don't know

[earnest rover]

fair

[sudden trail]

@green mason Thanks for your help I got there in the end.

[green mason]

yw

[sudden trail]

I was being a complete dumb ass. I wasn't putting the GET request in the VM to get the flag I thought the answer was the correct request.

[loud dew]

Hello everyone

Why you guys don`t sleep yet?

[fallen compass]

hey

[dry warren]

Hey i am on the module 'Web Requests' and section 'POST Requests' i can't login to the admin account with the credentials they give are you guys having issues as well

[sand bear]

Yeah I just found how to do it

Here's a hint: cookie is the way to reach admin, not URLs

[dry warren]

i get that but seems really weird that then then explain prior to it that we are able to logon to the account with admin:password

[sand bear]

Did you login using the credentials mentioned in the question?

You'll get cookie only if you use the right credentials

[dry warren]

they specify two credentials

'guest / guest'

admin:password

and the guest account works perfectly
but the admin account according to the post you should be able to login to as well

[sand bear]

'guest / guest'
@dry warren You had to use these credentials. Now you have a cookie. ||You need to edit your cookie to reach admin||

[dry warren]

i know but why does it say this then initially https://gyazo.com/ecc8840b6a7c53537832d240c48e8b42

[sand bear]

Let's talk on DM

[dry warren]

cool

[dapper belfry]

@dry warren

look at the note

[dry warren]

i know but why say other thin below

that

[dapper belfry]

that's the section

you literally do the same thing with the guest account

[dry warren]

okay maybe now i understand

so they user admin:password on their side for this exercise and we were just supposed to follow along with guest guest

[dapper belfry]

indeed

as for the question, look at the hint

[dry warren]

i have solved

np i was just confused and di not move on because i thought i should be able to login with admin:password credential on /login.php as well

[rustic sage]

anyone got time to help me out with the POST question, i got a guest/guest cookie and i am struggeling with the randomized second part of the cookie

[exotic current]

Cookie/ admin-wise - Me to, set it, using it, the page even says welcome admin_ but missing something

[tough fjord]

so the randomized second part is just a unique identifier for the guest account

why would a proper admin account need a unique identifier......

[rustic sage]

ah

@tough fjord thank you very much

[tough fjord]

[exotic current]

@tough fjord Lightbulb 🙂

[rustic sage]

Hello ! I know it's been a lot of questions for this specific module (POST Method) but I'm stuck and idk why.

I managed to connect to the admin by modifying the guest cookie. I have a sweet "Welcome, admin_!" as a Response, but I can't find the flag. I've been struggling for hours now, what am I missing here ? 🤨

[green mason]

@rustic sage you have extra thing but not missing something

it may shine without an underscore

[rustic sage]

Omfg I'm such a stupid ass

Thanks a lot lol

One more thing : it wasn't clear for me that I needed to edit the cookie. Tbf I would never have thought of that if I hadn't come here. Is that supposed to be obvious ?

[green mason]

@rustic sage i have solved many labs related to web, but i also couldn't figure it out directly

so it is normal

[rustic sage]

Okay that's a relief then, thank you !

[pliant pewter]

can someone help me?

[tough fjord]

@rustic sage it's all part of the hacking discovery. play around with things and see what they can do. The web requests module makes more sense if you do the javascript deobfuscation one as well (they are on the same path) as it will tell you about cookies and doing things like this

[rustic sage]

Yeah I'm currently taking this path :)
The thing that worried me is that I didn't get what I was supposed to do in an entry-level module, that isn't what I'm used to with online courses. And that's great !

[pliant pewter]

can someone help me please? I have been suck on this one thing for days

[exotic current]

which bit?

[pliant pewter]

which bit?
@exotic current I need help with WINDOWS FUNDAMENTALS, Introduction to Windows!

[exotic current]

Not tried that one yet sorry :/

[pliant pewter]

damm

[exotic current]

I'm having a brain fart about javascript flags

[rustic sage]

Is there a way to get Burpsuite on command line only ? I keep getting lost in this GUI

Or maybe there's a console hidden somewhere to understand what's going on

[pliant pewter]

i think there is

[tough fjord]

no there isn't.

for the purposes of this the main things you need are the proxy tab and maybe the repeater tab

[green mason]

and it would be hard to use

[pliant pewter]

really, I thought you could

[fair vine]

re the POST module, im intercepting/editing the cookie being on the POST request... am i on the right track?

i logged in successfully as guest/guest to create it

(the cookie)

[tough fjord]

yep

[fair vine]

so close 😭

[strong lynx]

hi, i'm doing the js deobsfucation, but when it comes to page 9, no matter what i try, it doesn't give me ✅ on the question. I tried everything.

[fair vine]

i found the flag but its incorrect 😮

[tough fjord]

Then its not the flag

[fair vine]

ah man is said admin and here is the flag....

decoy?

[tough fjord]

@fair vine if it says here is the flag make sure you are copying it correctly or the right bit

[fair vine]

quite sure i did but will ahve a nother go

it says the flag is "then the flag"

i copy "the flag" but says incorrect

😦

thought id cracked it!

ignore me found my error 🙂

[tough fjord]

good stuff!

[fringe compass]

Im stuck on the GET method
I thought I had it right but I have been trying and it still says i'm wrong
Will you tell me if i'm close?
||GET flag.php HTTP/1.1 num1=1000&num2=337||
or
||flag.php?num1=1000&num2=337||

[exotic current]

@fair vine The flag is not always the same flag

[tough fjord]

you are close

but why is the HTTP.1,1 in the middle of of the request

[fringe compass]

oh whoops, it is supposed to be first

I think

[tough fjord]

no

that is the very last thing, seperated by a space

[fringe compass]

ok

thanks

[rustic sage]

hi, can i dm someone for Web Requests Post Method.

[drifting knoll]

hey everyone, now there is another new and free module out there called Linux Fundamentals. It covers everything to work with Linux efficiently and comfortably and some nice tips and tricks for experienced users. Check it out!

[exotic current]

@rustic sage - where you stuck?

@drifting knoll Nice

[rustic sage]

not quite sure i manipulate the cookie but don't know if im right

[exotic current]

The bit that threw me, was look at what you're actually setting

[rustic sage]

ty i got it .....

[tough fjord]

ohhh new module

struggling to keep up with all this new content

[fringe compass]

||GET / flag.php num1=1000&num2=337 HTTP 1.1||this better? I still haven't figured it out

[exotic current]

@fringe compass better, look at how the url and variables are combined

If you post in the browser with variables, Burp will show you how it's formatted

[fringe compass]

k

thanks

[exotic current]

my turn for the headache, done most of the Javascript one but the serial= bit for decoding still throws me, done curl and burp, so know I'm missing something subtle (and probably obvious)

[exotic current]

Nevermind, being dense, JS solved

[primal canyon]

Question about File Transfers module and the Linux File Transfer Methods segment question 2. I managed to upload the file by ||sshpass -p "HTB_@cademy_stdnt!" scp upload_nix.txt htb-student@10.129.33.197:||. However, when I then run the hasher command it gives an invalid flag even though the contents of the file is the same as the one downloaded?

[midnight aspen]

I am working on Cracking into Hack the Box. However, none of the services are running. For example, I am supposed to go to http://206.189.25.23:30147, but that doesn't work. Later on, I am supposed to go to http://inlanefreight.com/search.php, but that page doesn't exist. http://inlanefreight.com only redirects to https. Any ideas how to get past this? As it is, I cannot get past the GET Method section.

[tough fjord]

you have a target instance you spin up yourself at the bottom

[gray ginkgo]

Am I being thick or confusing stuff? npm is a packet manager for nodejs AFAIK. How is it suppose to run a simple server?🤔

[midnight aspen]

@tough fjord I have the instance running. I can even get to https://inlanefreight.com. None of the other pieces are working.

[tough fjord]

no you target your own instance

those are examples - you apply it to your target

[midnight aspen]

I am trying. I did an ifconfig to get my IP address and that's not working either.

*I targeted my own IP

And the inlanefreight.com pages are not working properly. I should be able to get to /search.php and that results in URL not found

Oh s**t...I see what you're saying. I feel like a dumba$$

[green mason]

@gray ginkgo i am running server with npm

[midnight aspen]

@tough fjord I was able to get past the part with the IP address. But the :80 version of inlanefreight.com is redirecting and the search pages are not working. Nor are the get statements.

[exotic current]

@midnight aspen lanefreight is an example only for the tutorials, the "spawn your target" at the bottom of each page provides the same functionality

[midnight aspen]

Good lord. I think I need more sleep.

[polar drum]

how do you access the modules? im only seeing machines and challenges

[tough fjord]

academy.hackthebox.eu

[polar drum]

gotcha, thanks

[wicked cedar]

Am I being thick or confusing stuff? npm is a packet manager for nodejs AFAIK. How is it suppose to run a simple server?🤔
@gray ginkgo no this is pretty much where I'm at too

i am running server with npm
@green mason a hint would be much appreciated, I can't see anything documented in the man page

since "sudo npm install --global http-server && npm start http-server" is not the answer

nor is sudo npm install -g node-static && static -p 8080

[sudden trail]

I'm getting really confused with the POST method and the question Login with the credentials guest / guest and try to get to admin.
I get that I have to play with the cookie using burp suite but having not used burp suite until yesterday I don't really get what play means. I've followed the example instructions using guest guest but I'm a bit lost.

[wicked cedar]

so what's the sequence of events when you authenticate as guest? what's happening in each of the request and responses?

[sudden trail]

looking at the Proxy /Intercept on burp I get
POST /login.php HTTP/1.1
Host: 165.232.47.168:30846
User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 29
Origin: http://165.232.47.168:30846
DNT: 1
Connection: close
Referer: http://165.232.47.168:30846/login.php
Cookie: auth=Z3Vlc3RfOGYwNzMxYmMxNWI4YmViZDE2MGI%3D
Upgrade-Insecure-Requests: 1
Sec-GPC: 1

username=guest&password=guest

I then send that to the Repeater

Hit send

[wicked cedar]

looks like you're already authenticated as guest there though

[sudden trail]

Then I get the response 302 found with the Set cookie shown.

So do I need to clear the cookies?

[wicked cedar]

yes and no, seeing how the cookie changes each time you re-authenticate might help you

[sudden trail]

I think I'm going to have to do some training on burp first. I play around in burp and the actual web page just looks like it's trying to load all the time from the login page. The only way I can get it to do anything different is to drop and turn off the intercept.

[viscid lion]

Hi everyone, I'm having some issues in understanding what is the answer requested in the POST method part of the WEB Requests room

I got to admin, but I don't see any flag there...

[plush jetty]

I=If you got admin the flag should be displayed in the page

[viscid lion]

all I see is "Welcome, admin_%randomstring%!

So I'm wondering if I'm missing something...

[plush jetty]

that's the problem - that's not admin - 'admin' is admin 😉

DM and I'll help you out

[green mason]

i haven't solved the module, i have stated that it is possible. we are doing that when developing apps

[rustic sage]

Hello ! I'm working my way through the fundamental Web Request module and I'm currently stuck on the PUT and DELETE methods since yesterday noon. I think I understood the vast majority of the course, but some elements are still vague to me. I'll be quick.

**Context **: I managed to PUT and DELETE the hello.txt file without a problem, but when it comes to a php file it seems different and I don't understand why.

• The PUT method works like a charm (did it three times), but the DELETE method seems not to work : DELETE /flag.php HTTP/1.1 answers with a HTTP/1.1 200 OK and shows me the Headers and content instead of deleting the file. Why is that ?

• I noticed some requests could'nt be processed by the server (or the client ?) if there is not the right number of line breaks at the end of the request. i.e DELETE keeps Waiting without a Response if the request stops at the eighth line (Cache-Control : max-age=0), but answers if I add two line breaks after the last Header. Is it abnormal ?

Sorry for this long message, but I'm really confused and I know there's something I misunderstood somewhere.

[shy flower]

DM me. I'll help

[rustic sage]

Despite our good will, @shy flower and I could'nt understand why I can't DELETE a .php file while a .txt file worked fine. Does someone have the time to dive into this with me ?

[rustic sage]

Just finished JavaScript Deobfuscation and had already completed Web Requests, this made Cracking into Hack the Box say 100% but is says i have not completed any paths.
Am i missing something or does it just take time?

[drifting knoll]

can you send me a screenshot @rustic sage ?

[warm quiver]

mine took a minute to refresh

try refreshing page

[rustic sage]

Thanks @warm quiver just had a chat with @drifting knoll and after going back into JavaScript Deobfuscation and pressing finished again it added a complete path to the dashboard.

[rustic sage]

In case someone is wondering the same, the last section of the module Web Requests covers cURL, which can be used in this way 🙂

[fringe compass]

I am stuck on the GET method ||GET /flag.php?num1=1000&num2=337 HTTP/1.1||which is closer?||GET /flag.php?num1&num2=1000+337 HTTP/1.1||

[tough fjord]

first

[fringe compass]

ok

[fringe compass]

Will you tell me if I have all the info and just have the wrong order or if I am missing something and need to go look again ||GET /flag.php?num1=1000&num2=337 HTTP/1.1||

[tough fjord]

that looks ok to me, so odds are something else is wrong with your request

[drifting knoll]

for me too

@fringe compass check the url and make sure you set it properly

[fringe compass]

whenever i put in a url it is blocked and won't work so burp won't show me anything

[drifting knoll]

is there a way to submit creds in a url?

[fringe compass]

idk

[drifting knoll]

then you should go through the section again and read it carefully

[fringe compass]

ok

[past scaffold]

stucked to POST quiz. in "Welcome admin_hash!" is this hash something?

[tough fjord]

it's a unique identifier for guest accounts....

[past scaffold]

my bad i thought was more difficult than that. thank you

[tough fjord]

np

[fringe compass]

for the get request am I supposed to put the request in the browser?

[green mason]

Yes

But only the url, not in the form you see in burp.

[fringe compass]

ohhhhhhhhhhhhh

ok

thanks!

[green mason]

yw

[fringe compass]

I got it!! I feel so dumb that I didn't realize that it wanted me to put it in the browser LOL

[twilit fractal]

In get request module inlanefreight is converting directly to https

I am not getting http

[fringe sparrow]

@twilit fractal Use the IP address instead

[twilit fractal]

Ohh ok thnx

[fringe sparrow]

Adding it to your hosts file should fix it too if you want to use the url

[twilit fractal]

I'm sorry I didn't get u

I dont how to add hosts file actually

I will surf the Google for it

Thnx for helping me out

[primal summit]

I've been at this for an hour now and can't figure out why this doesn't work for the Web Requests: GET Method lab. Any one know why?

http://[spawnedIP:port]/flag.php?num1=1300&num2=37

[drifting knoll]

maybe you forgot to add something

[primal summit]

damn

[drifting knoll]

use proxy to analyse req&resp

[primal summit]

kk ty

[wise badger]

Hi there. I am having the same issue except that I could not get to admin on Web Requests module , POST method section. I believe I followed the docs, but I just can't understand what do I do to obtain admin. Can anybody help?

I get guest authentication OK, with page displaying Welcome, guest_<hash> . But I don't know how to get to admin.

[dapper belfry]

Inspect the request flow in burp

[wise badger]

What do you mean by 'flow'? As I understand, there's smth to do with changing the Content-type header to bypass authentication, but does not seem to work for me.

[pulsar mica]

SO i'm having a bit of an issue with web request POST method lab...

actually same thing with elkampa 👀

[dapper belfry]

Flow as in what all it does from the moment you login

[wise badger]

I got you. I understand the flow: POST request with sending form, then I get 302. Then the next is GET to the /admin/dashboard.php with the cookie set from previous request.

[dapper belfry]

Did you look at the cookie then?

[wise badger]

Yes. I get a cookie 'auth' which is used in the GET request to go to /admin/dashboard.php . That is guest's auth cookie.

[dapper belfry]

Well, see what you can make out of the cookie

Stuff from previous sections should help

[primal summit]

facepalm I forgot to use the provided login creds.

[primal summit]

TY! perfect hint

[wise badger]

Sure thanks. The hint says also smth to do with the cookie. Now I get , 'Welcome admin_<hash>' . Now what?

[dapper belfry]

Make it just admin :)

[wise badger]

Oh...thanks. This was hard! I thought it was to do with changing the Content-type header json or not json. Confusing.

[rain valley]

++identity i'm stuck hereTarget: http://178.62.0.100:32673
Time Left: 39 minutes

• 2 Send a GET request to flag.php with two parameters num1 and num2 such that their sum is 1337.

++identity curl 'http://178.62.0.100:32673/flag.php?num1=668&num2=669'

here is my answer

should i include the credentials?

[primal summit]

yes

[rain valley]

curl -u admin:password 'http://178.62.0.100:32673/flag.php?num1=668&num2=669'

[primal summit]

idk, I did it in the browser

look right to me though

[fringe sparrow]

@rain valley that curl command worked for me

[primal summit]

👍

[rain valley]

this what i've been trying to submit but it won't accept it

[pulsar mica]

my brain right now trying to figure out the post method section

i've been at it for 2 hours

[wise badger]

how come?

[wise badger]

i had issues with it, too . was a bit hard 🙂

[oak snow]

hi

[pulsar mica]

have no clue how to get admin and it's slowly hurting my brain i'll get it eventually

[wise badger]

it's very easy. do you have the flow when you pass the login page with guest/guest, you get the cookie?

[pulsar mica]

yea, the guest cookie?

[wise badger]

yeah

[pulsar mica]

yeah i got that

[wise badger]

ok. see the next request that will get the dashboard page. you'll need to see what you can do with the cookie.

[wise badger]

get rid of the extra _ and the rest

[pulsar mica]

do i actually need to do the json thing for this?

@wise badger ^

[wise badger]

no, that was confusing to me too. nothing to do with the json or manipulation of content-type header

[magic bough]

Hey guys I'm trying out File Inclusion / Directory Traversal : LFI to Remote Code Execution (RCE)

The first question : Using the LFI to RCE vulnerability run the command 'uname -a'. Submit just the Linux Kernel version number as your answer (i.e. Debian 3.19.42-2)

I tried using GET /index.php?language=/var/log/apache2/access.log&cmd=id HTTP/1.1 just to make sure it's working

but it's not

also tried to uname -a in the User Agent :/

Maybe i misunderstood the goal

[pulsar mica]

i thought it had something to do with the json for 2 hours, i feel stupid

thats what i get for trying to think too hard

[magic bough]

Anyone can help ?

with File Inclusion / Directory Traversal : LFI to Remote Code Execution (RCE)

[spare crane]

looking for a hand on windows fundamentals

[fringe sparrow]

@spare crane Whats up?

[spare crane]

Just overthinking i got it lmao. Thanks tho

[wise badger]

Hey @magic bough , it looks like that's a medium level module, here this channel is for fundamentals

[magic bough]

Oh okay thanks for telling me

I didn't notice

🙂

[spiral mulch]

i cant get a response in burp on the request and response module

anyone got advice?

[warm quiver]

Got stuck at the "Find a way to start a simple HTTP server using "npm". Submit the command that starts the web server on port 8080.", any hints, please?

[rain valley]

i'm close to throwing my pc out of the windows

i got this for the POST module

Admin panel

Welcome, admin_248421c3c0e8a23832a8!

by intercepting the response to the request and forwarding it then i modified guest by admin

this is what i try to submit 248421c3c0e8a23832a8!

but it doesn't work

help

[warm quiver]

Does admin need the unique id like guests? 😉

[warm quiver]

Am I even close with this npm question in Linux Fundamentals? ||npx http-server -p 8080||

[drifting knoll]

why npx?

[warm quiver]

to run it without install

[drifting knoll]

how would the command look like after you have installed it?

[warm quiver]

npm run i gues

[drifting knoll]

did you read the hint?

[warm quiver]

yes, hence the non-install npx

[drifting knoll]

do you really need to use a package manager to run a server?

[warm quiver]

🤦‍♂️ got it, thanks

I've spent waaay to long overthinking that one, thank you @drifting knoll 🍺

[drifting knoll]

you're welcome

[trail sleet]

Since you're right there, mr Cry0l1t3, is this query supposed to return a single file?

[drifting knoll]

@trail sleet yes