modules

[trim scaffold]

This was in regards to the Cracking Into Hack the Box / Web Requests / GET. Thanks

I did try to search this discussion thread and saw a reference but no answer on if the page is working correctly or not.

[crimson path]

DM me, lets see if we can work through it.

[vast thorn]

Hey Total new person here. I'm currently working through Linux Fundamentals, and I'm on Service and Process Management. I can't seem to SSH to this target here, and I swear I'm providing the correct syntax. Any ideas what I could be doing wrong? https://i.imgur.com/kqRoPSr.png https://i.imgur.com/CcRaeJh.png

Oh ignore me, continuing connecting worked anyways, but I didn't have to do that last time they wanted me to SSH to another user. It really threw me off.

[rustic sage]

It's expected to return 200 for all since you are only changing the header. Please add the filter flag to ffuf and your result is right there.

[stone dew]

Can someone give me a hint for the Windows Privilege Escalation Skills Assessment - Part I, for the privilege escalation part? I got a reverse shell back from the web application and tried the obvious thing to privesc which should work when I understand it correclty but I can't get it to work 😦 So It's probably not what I should do. Any tips for this?

[low echo]

Is anyone else having issues submitting answers on the OSINT module? There are at least 4 answers that I can't submit (just hangs)

[agile oriole]

Hello together, I got the flag in the Modul XSS/Pishing part, but it wont be accepted. I already restarted it. Im relative sure I did everything right. Inserted right XSS in urlform, start a server, send the creds to me, and copied the link to the send.php, which sends the real credentials. With those I got the flag... but doesn't work. Any help?

[red obsidian]

The specified CTF is invalid.

[plain cove]

hello everyone

Do you know that when using ssh2, if you do not operate for a long time, it will exit?

How did he quit automatically

plases,help me.

[rustic sage]

It will disconnect an idle connection due to security reasons. Are you on the host or client-side?

[plain cove]

host

Client-side won't?

[plush oyster]

Hi everyone!

new to the channel! wanted info of books to read while doing the htb academy

thanks in advance to all!

🙂

[agile oriole]

Thanks for answering. I does not understand whether its my fault or is it a problem in the box? If the box has a problem, get the students who bought it an info, when its fixed? Thanks!

[rustic sage]

Only client-side. What are you trying to solve exactly? You can configure the client to send a KeepAlive signal so the server will not disconnect.

[elfin laurel]

Hi, regarding the « File upload » module. I am stuck at the skill assessment section and I can’t find a way to upload a php file. I did exactly what is indicated in the hint : find an valid extention and find a valid content-type header through fuzzing. I have tried them separately they work (with an image) but when I try to use them in a request with a php file is still fails. Am I missing a step ?

[languid dawn]

What are you doing? Because you can upload a real image that you know will be accepted, then intercept in burp, change the extension to .php, add your php code at the end of the file data

[copper creek]

has anyone done the linux/win privesc modules? if so, do u feel it was worth the price? just seems so expensive

[elfin laurel]

I was trying to craft an acceptable php file, I didn’t it was possible to add php code at the end of image data. I’ll try that thanks

[languid dawn]

[deft stratus]

Hey all, was curious how you guys felt about the academy modules. Trying to study for OSCP and was wondering if these modules has helped anyone a lot on their journey for OSCP. Currently spamming HTB boxes and even though I am learning, I feel like I need to more fundamental learning for some specific processes that kind of match the hierarchy of HTB modules. Any insight at all is appreciated 🙂

[high zinc]

Many of the modules provide a lot og value that can be utilized in the OSCP exam and course itself

There is not a specific "study path" though however many of the topics covered are topics you will need to know to pass

Keep in mind though that the course part of OSCP is fairly extensive too

Have you checked out the ToC of the training material? You don't want to buy a module at HTB that is already extensively covered in the OSCP course material

(There are only so many different ways to explain what a simple SQL Injection is)

[deft stratus]

If you mean the pwk, I have taken a peak at it. Problem with that guy is that its like 1500 dollars for 90 days access which is crazy expensive. I am for sure getting it, just down the road as that will be my last training material before I attempt the exam. Before that however, I definitely wanted to view other trainings/courses so when I get to doing OSPG labs/The pwk, I will have a strong structure/experience of different common tools and methodologies.

I am going off the tjnull HTB list and starting with the easier boxes first, but I find even the easy boxes to be incredibly difficult. Was hoping of learning different concepts first through some sort of modules/learning academies hence being interested in HTB academy. I have bought/completed the Tiberous linux/win priv escalation udemy courses which were super helpful and was hoping that maybe the HTB academy modules were like that too. But I see what you mean, there are a ton of resources out there that teach the same things. I am hoping to purchase the pwk and not have everything be a new thing to learn, but some to be content I have already seen. (escpecially if I only have 90 day access haha)

[high zinc]

PWK yes, but I think they call it ... SP-200? something-200? But yes... that one.

but I find even the easy boxes to be incredibly difficult
If you didn't it meant you were ready to prepare for the exam itself and perhaps even pass it on first try

@deft stratus as for tons of resources out there, what I meant was that I wouldn't recommend that you spend $200 on HTB Academy and then purchase PWK and realise that 4/5 things that you purchased from HTB you would have learned in PWK anyway. That would be a shame

That said, the modules on HTB Academy tend to dive a lot deeper than PWK does for their topics

Where PWK tends to give the student the basics and enable them to continue their studies, HTB Academy will include much more for that particular topic even if they still expect you to do some self-studying and thinking "outside the box"

Take scripting or nmap as an example: in PWK introduction to scripting and nmap was - 3 years ago when I did it - very simple and just brushing the surface. Certainly not enough knowledge to just start writing your own tools and scripts and certainly not more than the basics of basics in nmap

the Academy modules for Python Introduction (one that I wrote) and nmap (forgot who the author is), the student is taught a lot more than the mere basics. My scripting module teaches you enough concepts for you to be able to write much more complicated scripts than you'll ever need during OSCP for example, even if the learning curve perhaps is a little steep for complete beginners.

The same goes for nmap: you'll learn more about the tool than you'll ever need in OSCP

(e.g. you don't need to care about a blue team trying to stop you so there's no need to learn how to stay covert)

I would personally recommend that you try to stick to the list of easy boxes along with watching IppSec doing easy/medium boxes on YouTube as well. I promise you will learn a ton from doing that because he tends to do the same exploits multiple times, if there are interesting alternative paths. Even experienced people learn new tricks from him from time to time 😄

Oh, and the Starting Point machines if you haven't already. That, and perhaps you could look at the Dante Prolab. It's supposedly a really good pre-coursor to OSCP. A little tough still perhaps if you are struggling with easy boxes, but when you get a better feeling for the easy ones and feel that you can do them with some or minimal help, definitely check that out too

[deft stratus]

@high zinc Thank you for all that info. Much appreciated! Yea its hard to define a path to take that cert when there is no defined path lol. I am used to cisco certs where you generally do a video course, lab anything up, do some practice exams and call it a day which the OSCP is DEFINITELY a different process haha. But I appreciate all of that, I think I'll stick to doing that list and basing each lab off the ippsec videos. I did all of the starting point but I will definitely take a look at HTB academy. If that goes way deeper than what I will need for OSCP vs the pwk just touching surface level, I would rather go way deeper. 🙂

Also I might do the intro to dante path too, that looks inticing

[icy snow]

Anyone able to lend some insight into the Windows Privilege Escalation Skill Assessment #1? Specifically the ldapadmin question?

[copper creek]

Would you recommend doing the First few easy boxes while watching the Video or try them on ur own First?

[copper creek]

Also, when to attempt Dante? Do a dozen of easy boxes First?

[copper creek]

just discovered that list, that lists netmon as more challenging than oscp. that gives me confidence 😄

[solar zodiac]

hi everyone! I'm doing the skills assessment and have found the IDOR and HTTP Verb Tampering, but don't see a way to get RCE or read a file from the system. If anyone could please advise I'd be very grateful 🙂

[hidden hill]

Hey guys. I'm doing the "Using Web Proxies" module and I'm at a module that requires me to use ZAP Scanner however I don't seem to have ZAP altogether on my instances, and Burp Scan is a pro only feature. Anyone know where/how I can get access to ZAP on the instance or do I just suck it up and go use an alternative ?

[lost kayak]

I just did the Server-Side Attacks Skill Assessment with no hints. Took me 2 days but man was that one rewarding.

[hidden hill]

Well done :)

[high zinc]

Not sure about that one..

[languid dawn]

Isn't dante easy ad? 😋

[burnt stone]

It's not solely "AD"

[runic rampart]

Hint:Examine the user database carefully.

[elfin laurel]

Hi! About the File Upload Attack skills assessment, I have troubles finding the upload directory, I searched in /contact and /contact /submit.php and the js script. Does anyone have a hint for this part? Also do you know any better methods to find the upload directory than reading the source code?

[wintry gorge]

i did the linux privesc module. Totaly worth the price, learned alot 🙂

[copper creek]

Cool, thanks. Think I'll do it anyways. Did you have any experience at all with linux priv esc before?

[copper creek]

Is it? I have no clue 😄 Just feels to me that it's way more advanced than 'just' doing easy boxes. Probably just my wrong perception

[rustic sage]

where do we ask help?

[west rampart]

just ask?

[rustic sage]

oww best way to crack a pass?

and where can i test that thing? of cracking a pass ( im sad i just said i will crack googles pass and i got banned ) :(

anyway where can i test that pass cracking thing?

[west rampart]

what passes you wanna crack?

[rustic sage]

hmm idk

i only have 4hr of xp in kali

and very little knowledge abot hecking

[west rampart]

but what passwords you're talking?

[rustic sage]

1 min let me think of that

[west rampart]

[rustic sage]

when i think of pass i only think of google and other web accounts >>>>>>>>

they are types of pass? ig i should watch a tutorial

[red obsidian]

https://lmgtfy.com?q=password hash

https://lmgtfy.com?q=cracking password hashes

[elfin laurel]

Hi! About the File Upload Attack skills assessment, I have troubles finding the upload directory, I searched in /contact and /contact /submit.php and the js script. Does anyone have a hint for this part? Also do you know any better methods to find the upload directory than reading the source code?

[lost kayak]

Best hint I can give you is to look at the other file upload attack sections and read the hint from the skill assessment. If you do both of these you will get it

[grizzled ibex]

Module: Web Proxies
Section: Skills Assessment
Question: Once you decode the cookie, you will notice that it is only 31 characters long, which appears to be an md5 hash missing its last character. So, try to fuzz the last character of the decoded md5 cookie with all alpha-numeric characters, while encoding each request with the encoding methods you identified above. (You may use the "alphanum-case.txt" wordlist from Seclist for the payload)

This question is driving me crazy! I know I have decoded the cookie correctly and I know how to re-encode the cookie with the .txt file reference. I've tried fuzzing the following 3 URLs with GET requests: /; /admin.php; and /lucky.php. I don't know how I could modify the POST request without trying to find a collision with the MD5 decoded cookie but that seems outside the scope of the module. The only way I see that being useful is in order to hack the password which is posted in cleartext.

I'm out of ideas. Can someone please give me a little hint to help me solve this puzzle???

[languid dawn]

I would use burp and simply do all the requests with each cookie, the one that is accepted is the correct cookie, once you have that you can set it in your browser and access the pages

[grizzled ibex]

Thanks, Greyer! Turns out i was encoding the cookie incorrectly. I thought i verified the encoding but I guess I didn't 🤦‍♂️

[stark tapir]

Hello, module File Inclusion - Skills Assesment looks like broken, no one of methods from module does not work (( any help pls

@winged hedge help pls

You have been infected with virus. Please evacuate !

[winged hedge]

my virus is working buahahah

[stark tapir]

can u help me with task pls? i think crackers down it

[winged hedge]

feel free to dm

[stark tapir]

what does mean dm? )

[winged hedge]

it means you may send me a personal message

[stark tapir]

Hello, module File Inclusion - Skills Assesment looks like broken, no one of methods from module does not work (( any help pls

[quaint cargo]

My issue too. Were you able to get that directory or did you just do it without?

[lethal atlas]

Can someone help with the Intro to Python 3 module? I am stuck on the last section "Managing Libraries in Python (Continued)" I have answered questions 1 and 3 and I know the answer to 2 has to be tuple but it doesn't accept it. Anyone have a hint at what I am missing? EDIT: I wasn't typing the < > . Always the simple mistakes.

[lethal atlas]

you have to enumerate the nibbleblog directory which will lead you to the upload directory. Upload a php reverse shell and then use curl to run it. Make sure you have a listener going.

[lethal atlas]

see my comment on alpha's original post.

[sharp rose]

Hi guys ! how many % did you get at the Hashcat Skill Assessment ? 🙂

[sharp rose]

so far, i spent the time.. got around 82% of passwords recovered. What's yours ?

[copper creek]

can someone help on the skills assessment for attacking common applications? close to the flag but missing something

[copper creek]

nvm, figured it out

[normal spoke]

Is Foxyproxy disabled for anyone else when doing the Web Requests module?

[copper creek]

kudos to the creater of attacking common application module, great module

[stark tapir]

Hello, module File Inclusion - Skills Assesment looks like broken, no one of methods from module does not work (( any help pls

[wintry gorge]

Yeah some exp from the boxes, so some things were familiar but a lot of things were new. And the approach in the module is manual rather than just rushing through linpeas.

[plain cove]

Does anyone fix log4jbug?

[restive smelt]

I'm stuck on the ZAP Fuzzer section within the Using Web Proxies module: I have found the cookie no problem, but I can't see how I'm supposed to use the fuzzer on it? I can't see where I can fuzz the response? Can someone help?

[quick hollow]

Also very stuck!

[restive smelt]

in that image, the cat command and pipe aren't being used correctly I think

you need to get into the directory you want, cat "file" to read its contents

[quick hollow]

Yes, thanks I understand that part it's the dir path I can't seem to find "./../ "

[restive smelt]

I found it by cd .. one step at a time

eg: 1;cd ..; cd ..; etc

[quick hollow]

hmm any resources you could point too?

[restive smelt]

not really, I just added a cd .. to ls+-a; until I found something interesting

[rustic sage]

Hi . I am stuck on Active directory LDAP search filters with this question: "Find another group, not listed in the section output, that harry.jones is a member of...

I tried to enter a lot of Powershell commands but results the same

[red obsidian]

https://lmgtfy.com?q=who is ur mom

[rustic sage]

cringe

[main vapor]

Tip of the day: When using Pwnbox and Ctrl is not working, press ESC twice on your keyboard and that should be the same as if pressing Ctrl.

[copper creek]

Thanks for the reply. Finished it as well today great module. Glad I took it 🙂

[gray wing]

Hey guys, I hope it's okay to ask this question.

Has anyone done Cracking passwords with hashcat? and if so, did anyone have issues when attempting the Working with Rules assessment? I'm following the hint provided but I keep getting the exhausted status. I even tried to use a Combination Attack instead

[formal vessel]

anyone around that can assist a little on the login brute forcing - web login assessment? Im working through it, hint says to re-use a username previously found but nothing is clicking after 4h of running wordlists at it

[main vapor]

@formal vessel DM me.

[main vapor]

@gray wing DM me.

[crimson path]

@main vapor Have a moment for a DM question on Getting Started mod?

[main vapor]

@crimson path I did not do that one but no problem I will try to help.

[quick hollow]

Can you please provide me a hint been stuck for awhile!

[trim scaffold]

@lean saddlerator Is there an issue with the Cracking into Hack The Box / Web Requests / GET? I feel confident that I have the correct answer to the flag.php question, and I can curl and get the flag through the browser., but the question I cannot seem to make happy.

happy to discuss DM

[normal spoke]

@trim scaffold you can DM me. I did that one a few hours ago.

[novel matrix]

[primal terrace]

can someone help me with the Attacking Common Applications skill assessment 1 module? i tried using msfconsole/fuzzing and got nothing

[weary forum]

Hello, everyone. I am having trouble with JavaScript Deobfuscation Module. This has to do with this question:

"Try applying what you learned in this section by sending a 'POST' request to '/serial.php'. What is the response you get?"

[copper creek]

what files did you fuzz for? 🙂

[primal terrace]

anythign

thing

[weary forum]

What I am trying to do is to intercept the HTTP requests for the target using Burp

[primal terrace]

got a working uri on metasploit and it wrote that its vulnerable but still didnt work

[weary forum]

Unfortunately, the Firefox proxy is turned off by default. I am not sure how to turn it on....

[copper creek]

hint: cgi-servlet

[primal terrace]

didnt found cgi-servlet 0_0

ty

[weary forum]

However, the curl command didn't work. My curl command was curl -s 167.99.89.198:32759 -X POST

I also tried curl -s 167.99.89.198:32759/serial.php -X POST, but I got the same result as I did for the previous POST request to /serial.php

I was thinking that maybe burp might work

[trim scaffold]

AGrinch helped me out. thank you. I was getting the correct answer but misunderstanding what the question was asking for.

[novel matrix]

😂. You can’t ping staff so you pinged a random member

[trim scaffold]

sorry about that

new to Discord

[copper creek]

isn't it explained in the module? not sure if this was a different module. you don't need to intercept anything for this question tho

[quick hollow]

Please provide hint if solved !

[stone kraken]

Hello everyone, I am is developer php and nodejs , i want to learn hacking

[mild kettle]

Haven't solved it yet

[main vapor]

@mild kettle @quick hollow DM me.

[weary forum]

Well, I am doing what the module says, as you have to send a Curl request to /serial.php. I am not sure if the problem is how I am formatting the request.

For example, I am doing curl -s 167.99.89.198:32759 -X POST

but this request has to point to the /serial.php (script?)

curl -s 167.99.89.198:32759/serial.php -X POST. I am thinking that /serial.php might be a script.

[copper creek]

this will give you the answer to the question

unless your box is down that will return you the string for the quesiton

or if you have the wrong ip

[keen valley]

I am new

hello

[rustic sage]

What

[balmy night]

hey guys i need help with a question from HTB academy. Im using burp intruder to find .html files under admin directory not sure if its the list of payloads im using or i have the payload position wrong. Im working on "using web proxies" module.

[quick sail]

hey

i need help, im doing the web enamuration module under getting started

and whenever i do the gobuster dns section

i get an unable to validate base domain error

any ideasa?

ive tried basically eveerything

[rustic sage]

send your full command

[quick sail]

sorry for the screenshot

i mean i got the answer for the module just confused why gobuster wasnt cooperating

[wary stump]

hi . has anyone an idea or solution how to solve this problem:

Traceback (most recent call last):
File "joomla_dir_trav.py", line 25, in <module>
import click
ImportError: No module named click

its in module attacking common applications -> joomla

i have done now everything i found to fix this but its not possible to fix it

i deleted the modules, reinstall pip nothing helped

its this exploit to run it in python2

https://www.exploit-db.com/exploits/46710

[rustic sage]

You need to put the url switch

-u or --url

[quick sail]

ohhhhh

small brain

thank you soc1ety

[rustic sage]

anytime

[quick sail]

@rustic sage mind if i ask you one more thing

[rustic sage]

yep go on ofc

[quick sail]

im doing the public exploits module

and im using nmap rn

and for some reason

it shows 0 services

nmap 167.99.202.131:31219, says cant resolve

and nmap 167.99.202.131 aswell

if i add -Pn it scans but finds nothing

tried refreshing the box 167.99.202.131:31230

same thing host seems down

[rustic sage]

try nmap 167.99.202.131 -p31219

or -p followed by your port

[quick sail]

host seems down

[rustic sage]

Shoot me a friend request we'll see in DM if you don't mind

[quick sail]

not accepting friend requests

you shoot me one

[rustic sage]

aye yeah I always forgot, pardon my dumbery

sent

[copper creek]

run it with python2.7

and you need click for python 2.7

[weary forum]

Ok, thanks. My pwnbox was down, and I got the flag. However, I have another problem with question 3 under the Skills Assessment for that module: "As you may have noticed, the JavaScript code is obfuscated. Try applying the skills you learned in this module to deobfuscate the code, and retrieve the 'flag' variable."

The deobfuscated var flag was HTB{n" + "3v3r_" + "run_0" + "bfu5c" + "473d_" + "c0d3!" }

[copper creek]

You can use Decoder for that in Burp suite

[weary forum]

I am not sure what the hint means to stitch it all together

[languid dawn]

@weary forum is that a real flag? If yes please delete it. Don't post flags of active modules

[weary forum]

No, it's not the correct flag

[languid dawn]

OK then just ignore me

[copper creek]

did you get it? you don't even need decoder for it, can also just console log it to get the correct output

dm me if you need more help

[past scaffold]

can anyone help me in web attacks - skills assessment? 🙂

[lament hollow]

Anyone around that can give me a hand with the MIC flag in the Hashcat module?

I've triple checked my syntax against the lesson, verified no failures during the binary creation, every time I get exhausted using the rockyou wordlist. A search here found 2 others that had the problem, one of them said they got it working by trying it on an a pwnbox, I've done it now on my own Parrot VM as well as PWN and I'm getting the same result on both.

[main vapor]

@lament hollow DM me.

[weary forum]

Yes, I got it, thanks so much. It's just that the hint was confusing.

[slow bluff]

HI! about file upload attack skills assesment i am able to read /etc/password but i couldnt get the flag any hint pls

[slow bluff]

HI! about file upload attack skills assesment i am able to read /etc/password but i couldnt get the flag any hint pls
Replying to M4d3y3
ON

Message #modules

[sweet scaffold]

Hi, so I'm doing Knowledge check on getting started module, got admin credentials, connected to admin login page but says that credentials are not correct. Any idea?

[solar zodiac]

Hi everyone! I can't find the upload directory for the skills assessment for the File Upload module. I've searched the JS code and all the other code on the site. Any help would leave me forever in your debt 🙂

im thinking my javascript reading is off :S

[small panther]

Can anyone give me some help with the hashcat Perform MIC cracking?

[paper gust]

MIC cracking?

if you are having issues with hashcat, let me know

[solar zodiac]

I think the xss phishing module exercise is broken... its been loading for about 10mins

i've refreshed the page a couple of times

[dusk bronze]

HTB academy having some outages?

OSCP grads, how prepared would I be after completing all skill paths, including solving a few boxes each week? (I'm taking the next semester off Uni, so I'll have too much time to waste)

[frail nimbus]

How to hack

[slow bluff]

Look for "url"

[gloomy tangle]

Hi everyone. Can someone help me on the the section " RCE via theme editor" exercise from module "attacking wordpress" from the hack academy? I am stuck. thanks in advance.

[sweet scaffold]

Hi, can anyone help me with privilege scalation for root flag in getting started module, knowledge check, 2nd part

I already got directory with sudo privilege with sudo -l. I dont know what to do with gtfobins

[sweet scaffold]

if i try to run reversed shell command from gtfobins it gives me error unable to connect

[sweet scaffold]

Got it working now

[past scaffold]

can anyone help me in web attacks skills assessment i stucked 🙂

[runic rampart]

Where are you stuck?

[past scaffold]

thanks for your interest i found the solution!

[lilac osprey]

can anyone tell me how to start learning

[woven talon]

you have to create an acadamy account

https://academy.hackthebox.com

[rustic sage]

Hi, anyone can help me in the Hacking Wordpress module? WPScan give me that the host not running wordpress.

[solar zodiac]

I only found the /contact/upload.php :(. I have no way of viewing the upload.php source code

[solar zodiac]

is there anyone that I can dm about this? 🙂

[fickle spruce]

Currently fighting Firewall and IDS/IPS Evasion - Medium Lab, any tips?

Scans seem to be running far longer then they should as well.

[slow ruin]

Hi, I am stuck on the Skills Assessment - File Inclusion/Directory Traversal module. I feel I am really close to the flag but for some reason my cmd's are not going through to display the flag.

[solar zodiac]

are you using pwnbox or the VPN file? I had a box I couldn't reach unless I was connected to the VPN

[fickle spruce]

I was using a VPN key. Switched to Pwnbox.

[solar zodiac]

ah

[fickle spruce]

LOL Main part....... I was forgetting to check the status.php I was tripping the alerts and getting blocked. LOL Got carried away and was forgetting stealth....

[solar zodiac]

lol

[main vapor]

@slow ruin DM me.

[solar zodiac]

I wish I could figure out how to find the directory for uploads in the uploads skills assessment 😦

I think I've read all the code... and found the php file the upload is making the post request to

but I cant see the source code of the php file

im not good with webapps :/

[earnest flame]

Hey don’t post that please as it’s a solution

[languid dawn]

👍

[icy night]

Who can fix this mistake, she is more than 3 months old.

[earnest flame]

What ?

[icy night]

Writes that the flag is not correct.

[earnest flame]

Thats because it’s not

The \xYZ is just a representation of non-printable characters

Remove those

[agile oriole]

Is it possible that the last Skill Assessment (Service Login) in the "Login Brute Frocing" Module does not work. I cannot reach a server, equal what I do. No contact in server, nmap, ping... Is it down since at least a day? VPN or From Box, both shows the same issue.

[agile oriole]

I wrote a weak ago, that the flags will not get accepted. Maybe they build it new. A pitty that the communication seems to be so underdeveloped. Guess they forgot, you pay for this...

[pine bough]

guys for some reason the HTB website wont let me submit the answer :/

any1 know a fix ?

its just stuck on this

wont tell if its a correct or a wrong answer

[languid dawn]

maybe remove the extra quotes

[pine bough]

thats not the prooblem

it just the same for any input

no response from site

[languid dawn]

maybe you're missing the http://

[fossil cloak]

In the Shells & Payloads module (Reverse Shells section) - I keep receiving an error of missing ")", ";", etc. in the provided PowerShell command. I copied and pasted into notepad of target as provided. Does anyone know if I need to further modify the PowerShell statement to remove the errors

[runic rampart]

Have you tried running in cmd?

[fossil cloak]

I had not - and that works. What is the difference between the two (or why does it work in one and not the other). Thanks for the feedback!

[runic rampart]

This module teaches us and says that a certain shell gives us different opportunities. I only started in cmd (disabled WD?)

[lilac niche]

Hey guys just a quick question. Who should i contact if there is a backdoor-programm in the Cheat Sheet from sql-injections cours?

i know a bit ironic

[main vapor]

Did you by any chance forget turning off BrupSuite?

[pine bough]

i didn’t use it

[fickle spruce]

@solar zodiacFYI, forgot to mention, I was able to get this quickly in the Pwnbox.

[lethal atlas]

sometimes you have to go back to dashboard, login back in, then try and submit.

[pine bough]

ill try that now

[pine bough]

no luck :c

[lethal atlas]

I went back and looked and my answer is the same as yours without the quotes. i.e <a href="website">

[lethal atlas]

its all about the script you run in nmap and make sure you only check the open ports

[fickle spruce]

Yep. I was having issues because I tripped the Firewall, couple spot lower I mentioned that. LOL 🙂

[lethal atlas]

Has anyone completed the module "DNS enumerationg using python"? I am stuck on the main function.

[lethal atlas]

ahhh i forgot how easy it was to do that. I just slowed down the scan time with -T2

[fickle spruce]

LOL Don't work on HTB while exhausted....LOL

[pine bough]

its not that

its just that the webpage doesnt give me a response when i input something

its just stuck on this

no incorrect answer either

[lethal atlas]

I guess contact support then. Does the hint work?

[pine bough]

yea

[lethal atlas]

strange.

[pine bough]

ikr

never happened before

[lethal atlas]

has anyone done DNS enumeration using python?

[solar zodiac]

Hi everyone! is anyone available to discuss the skills assessment for the web attacks? I've found IDOR, but am not sure what the next step is

[sweet scaffold]

Hi, I'm doing SQL Injection module and I'm stuck at Subverting Query Logic. I tried bypassing with or operator but when i try to login it always says error in syntax

Also checked query and there are no error but page says that they are

[lethal atlas]

guess we are all stuck here for now lol

[copper creek]

i really wanna do some AD/windows boxes the upcoming weeks, best module to buy is probably the windows privesc one for this?

[lethal atlas]

Im stuck on a python script that seems to stop here - zone = dz.from_xfr(dq.xfr(nameserver, domain)) - i can verify it works up till that line then nothing after seems to work nor does it throw up any errors.

[untold kiln]

Check this, maybe it is a AXFR denied
https://stackoverflow.com/questions/60784723/why-is-dnspython-zone-transfer-sporadically-failing

[lethal atlas]

I tried that one. Most of the code in it is depreciated.

[fathom garnet]

Help, how yo verificate?

To

[crimson path]

message the bot "HackTheBox" at the top of the server members list with ++verify and follow the steps

[fathom garnet]

Thanks

[solar zodiac]

Hi everyone! I'm still stuck on the web attack skill assessment. I've found IDOR ,nifty tokens, and verb tampering. Im not sure how to identify which account is an admin account since there is no role in the json data, and don't know how that would lead me to RCE anyways. If anyone wants to help I would greatly appreciate it 🙂 I

[stable sparrow]

hello friends! I was wondering if someone could give me a nudge in the right direction, been stuck on a question regarding active subdomain enumeration for a while now. how do I query individual zones for domains and how do I query these subdomains? 🙂

hey, how did you go with this? I'm pretty stuck on this section.. I can't get my head wrapped around on the zone transfer.

[mortal nova]

I’ve solved it. Will DM you shortly

[rustic sage]

Im trying to reach out to a support engineer for 2.5 hours now but still no answer...

I made a 450 eur purchase which needs to be resolved asap

can someone from the team pm me?

[nimble citrus]

anyone here subscribe student plan?

If i've already taken student plan, are the student plan will be available again?

[pine sable]

Hii 🙂
Someone have a nudge for Server-Side Attacks SA ?
Am unable to identify the technique to use.

[scarlet finch]

https://github.com/B1rby/Stack-Based-Buffer-Overflows-on-Linux-x86

[sly nebula]

Find a hidden Web page. Read every source you can read.

[woven talon]

hey there, im struggling with the correct answer in module "Introducing to Academy" Section " Interactive Section with Terminal" . They want to know the Operating System flavour. Isn't it " Debian 5.10.28" ?

[pine sable]

Thank's i got it😊

[random stag]

should i put the osi model on my wall or will that give me ptsd

in vocational school while i was in high school it was what i hated the most

[plain cove]

everyone，how do you know mysql_core

I want to know how he executed it

[sweet scaffold]

Same here, still not in my head, all i know is that there are 7 layers

[wind pebble]

anyone free to give a nudge on firewall IDS/IPS evasion hard lab

[wind pebble]

i guess my big issue right now is I'm only seeing two ports open

[unique star]

Hi, I'm stuck on the command injection module with the Skills Assessment, I've found the command injection but I can't make it works to show me the flag.txt. Any hint? 🙂

[main vapor]

@scarlet finch Are you sure this approach is correct? I opted to find the path on Pwnbox and got it correct from first time. ||"locate laudanum" does the trick I think 😇 . ||

[scarlet finch]

will send u a message in dm

[random stag]

yeah pretty much the same thing here

[hollow hearth]

Hello to all colleagues, could I get here a little orientation with a module?

[rustic sage]

Ofc but you have to directly state your problem in order to get help

[languid dawn]

[hollow hearth]

Thanks, it's my first time interacting here. I am in the final part of the Getting Started module, and in the final exercise, I have been able to obtain the user.txt file, my problem is that I cannot give root privileges from www-data and I only have access to the / usr / bin / php any suggestion on how to get rid of the privilege?

the plataform is getsimple

[main vapor]

@hollow hearth ||Have you checked GTFOBins? https://gtfobins.github.io||

[hollow hearth]

yes, I have tried some commands, but I am not sure if I have tried the correct ones,

i use https://gtfobins.github.io/gtfobins/php/#reverse-shell

[main vapor]

Use what the ||sudo section teaches. ||

[hollow hearth]

ty i tried too whit comands https://gtfobins.github.io/gtfobins/php/#sudo What I really don't know if I'm using the command correctly, since I've followed the example but didn't have success

[main vapor]

@hollow hearth DM me.

[hollow hearth]

ok

[main vapor]

<@&861185840277487616>

[surreal rain]

Thanks

[low cedar]

need some help with php web shells (last question) on #Shells & Payloads module #HTB: Academy. I'm doing something wrong, but not sure what

[unique valve]

Feel free to DM me when you have time. Ill help

[twilit bluff]

Hey all, I'm on the Knowledge Check of the Getting Started module. I feel like a dumbass, but I can't find the 'user.txt' file for the life of me; I've used metasploit and successfully got a shell on the machine, but looking through the directories I really can't find it. Short of dm'ing me, what's the most likely location for such a file to be?

[random stag]

i didn't do that module, though I'd probably try using locate or find first

[twilit bluff]

That's the odd thing, I went all the way to the root and did 'search -f user.txt' and it said there were no matches at all.

[unique valve]

Have you looked in the home directory for user directories?

[twilit bluff]

gahhh, of course, there it is! thanks a ton!

[unique valve]

No problem! Anytime 🙂

[trim scaffold]

Open question to anyone who has been doing the Academy courses. Does it matter if I use Kali on my own computer or is there benefit to using the PWNBOX instead. I notice that on occasion the results in the walk through / instruction pages do not always match what I see in Kali, so is that something that others are seeing? Sorry, noob asking noob questions.

[random stag]

have you tried downloading the vpn key for the modules

[trim scaffold]

I am using the openvpn and it works fine. I have been using VMWare and run Kali then VPN to my openVPN connection and work from there.

[scarlet finch]

I think it depends of the courses but I always used Kali personally. I dont like pwnboxes

[trim scaffold]

I figured I would float the question since I am pretty new to the Hacking / Testing. I have been working with computers for 17 years as a manager of an IT department, but this stuff is pretty new. I want to start off on the right foot.

[unique valve]

Great to have you. Id recommend starting with Introduction to Academy and Getting Started modules. Ultimately follow what interests you most and feel free to reach out here if you need a nudge.

https://academy.hackthebox.com/course/preview/introduction-to-academy

https://academy.hackthebox.com/course/preview/getting-started

[trim scaffold]

Thanks for the recommendations. I will take them. I have gone through the Starting point Tier 0 and 1 and part of 2, but I think that I need to go back and do these.

good call, I had done the Intro but not the getting started.

[languid dawn]

The starting point is great to learn the methodology to do boxes, that and ippsec videos

Also read ctf writeups

[trim scaffold]

I will put that in my notes.

[languid dawn]

I would also suggest making an htb account (not academy) so that you can ask stuff in the relevant channels

[trim scaffold]

I have an account for both.

[scarlet finch]

but the best way to learn is to practice, struggle and understand so don t hesitate to start a box.

[languid dawn]

Then you can use /verify and give your discord token to the bot in dm

[trim scaffold]

roger that. I would have to agree with that as well.

[scarlet finch]

isn t in the bot command ?

[languid dawn]

Like itnbob said, the best is to focus on what you like

[trim scaffold]

this is great feedback. thank you all for the help

[languid dawn]

But yeah take your time, enjoy the different stuff and ask whatever!

Np Np, have fun dude

[neat kindle]

Hello everyone,
I'm stuck at the Module "NETWORK ENUMERATION WITH NMAP" and I feel really stupid:

The task is to " Enumerate the hostname of your target and submit it as the answer. (case-sensitive)"
I can't figure out what I am supposed to do:

I tried:

• nmap -sL $TARGET : 0 hosts up --> So the hostname is not in DNS
• nmap -sC $TARGET -p- yields 7 open ports but I can't find anything resembling a hostname
• Opening the Website on the Target IP-Adress: Apache2 Default Page (no hostname here)
• ping $TARGET Target responds but still no hostname
• "www" is also not the correct answer

The current task teaches how to Discover open TCP Ports and UDP Ports. It is supposed to be a fundamental task but I'm stuck for like 1 hour. What am I missing? Can anyone help?

[neat kindle]

Solved.

[strong tide]

Hello everyone! Does any of you know the XSS module skill assessment? I remember the first days I approached it, when I tried to publish the comments, after the refresh of the page, the comments appeared, not comments don't appear anymore. Is it intended or not? I'm afraid it could affect my xss injection

[steel trout]

looking for a little nudge in the right direction on this one;
Module name: "Web Requests" - Section: "POST Method"
Q; "Login with the credentials (guest:guest), and try to get to the admin user from what you learned in this section and the previous section."
I have been able to login using guest, then manipulate the cookie to get to the admin user's dashboard, however I haven't been able to get a flag to pop.

[wind pebble]

if anyone's free, I need a nudge on Network Enumeration with Nmap - Hard Lab. Mainly having issues finding a port

[cyan pulsar]

Hello everyone,

Please can anyone help me with the module Getting Started - Knowledge Check.

The target is a web application using get simple cms which is vulnerable to php file upload vulnerability.

As of now I have enumerated the machine using nmap, gobuster etc.

I have found admin username and password of the machine and tried to use an exploit available in the metasploit. But it gives me an error stating exploit aborted due to failure. $ip upload failed. I tried changing the TARGETURI to all the available directories but still the same issue is coming. Please help if possible

Thanks in anticipation

[tepid apex]

hi - I'm working on the web requests module, I'm on the PUT and DELETE page where you have to create a flag.php file containing <?='cat flag.txt';?>, PUT it on the target system, and then request it. I've done all of this, successfully put the file there and successfully requested it, it contains the right stuff, but I don't see a flag - can someone possibly guide me towards doing it how the module wants me to? thanks in advance

nevermind

wow

so to anyone reading this having trouble with that module - don't bother reading the cheatsheet for help

the answer isn't in there

nor is it in the actual module content, just do 'curl -h' and you'll see the option you should use

[rustic sage]

What did you put for TARGETURI exactly ?

[safe token]

hey. could someone help me a bit with the web attacks module?

im stuck here and idk what im doin wrong

i have a problem with the bypassing security filters part in http verb tampering section

[stark tapir]

Hello! Module academy - "Attacking Web Applications with Ffuf" - "Skills Assessment - Web Fuzzing". Task "One of the pages you will identify should say 'You don't have access!'. What is the full page URL?" says that im wrong. But i found it. Whats wrong?

[west canopy]

@stark tapir check your DM's bud 🙂

@wind pebble check DMs 🙂

@steel trout check DMS too!

[rustic sage]

[sterile hawk]

[low girder]

[scarlet finch]

[stray fjord]

Did you ever figure out how get a shell on this one? I am stuck also on the last question of the assessment. I can't find a way into the tomcat application.

[stray fjord]

Can someone give me a hand with the last question in Attacking Common Applications Skills Assessment 1 please?

[subtle mulch]

Yes, ghostcat is not the exploit you're looking for. There ist another one where you have to guess a folder and fuzz the file name

[frail pike]

Hi im on getting started module section knowledge check and i have gained access to the console with msfconsole with an exploit but i do not know how to transfer the lineum.sh file to it because it doesnt have curl or wget

[winged roost]

Hey all, after some guidance/ nudge if possible, seems im partially losing the plot. the question is: Submit the FQDN of the nameserver for the "inlanefreight.htb" domain as the answer. Despite adding to /etc/hosts... im getting an error in nslookup, and for life of me cannot workout what im doing incorrectly. The error im getting is: "** server can't find inlanefreight.htb: NXDOMAIN"

[fickle spruce]

Still fighting with the NMAP Hard, I find the open port, but am getting

nc: bind failed: Permission denied

Stopped the service that uses Port 53 and no change.

This is via the Pwnbox, tried last night and was the same for both the pwnbox and vm.

Holy crap I'm dumb!

[winged roost]

Just about to type u need to sudo the nc lol

[fickle spruce]

LOL

[winged roost]

until i read the rest of your message lol

[fickle spruce]

When something doesn't work that you know should work...... its irritating because you know its going to be something stupid simple! LOL

[rustic sage]

In the Hacking Wordpress module on section "Directory Indexing" the target site loads infinitely when adding /wp-content to the end of the url, despite that literally being what it wants you to do. Nothing comes up using curl.

[simple bronze]

try /wp-contents/ with a trailing slash. I think i had that problem too

[rustic sage]

This module is making me go crazy, on the skill assessment section wpscan doesn't even recognize the target site as a wordpress site.

[solar zodiac]

Hi everyone 🙂 can anyone nudge on the directory traversal skills assessment?

I've leaked the php code and read index.php. I looked for config.php but it wasnt there 😦 I also noticed there was a filter on ../

[thorny ivy]

hi, you can solve the problem? im add blog.inlanefreight.local at host.conf and resolv.conf. nothing work.

Hi all. I'm stuck in the (hack wordpress) module in the last instance. I can't resolve the host of my target. (blog.inlanefreight.local) add to host.conf and resolv.conf file "blog.inlanefreight.local" but still not resolved. When entering the objective directly this load without problem, I mean the start page. but seeing the link where I understand that the target will be, I cannot resolve the host. Use vpn and also PAWN machine. in both change the settings several times. I also respawn on the target. I just can't resolve the host. or I think that's the problem. Any ideas?

[deft ruin]

Windows Fundamentals- skill assessment
Can someone help me for this 3 questions?
-What are the commands to type in the powershell to solve thees questions

[quick hollow]

ZAP Scanner, found high-level vulnerability yet can't seem to grasp how to find the flag. HELP!

[true gyro]

Hi, can anyone please help me understand where I'm going wrong in this question - under the web requests module in htb academy

[crimson path]

You're looking for the sum of two numbers

[true gyro]

Thank you. I realised it could be two values that I need to find out. I just tried ip:port/flag.php?num1 in the browser but I get a
Parameters not found! Error.

[thorny ivy]

Hi all. I'm stuck in the (hack wordpress) module in the last instance. I can't resolve the host of my target. (blog.inlanefreight.local) add to host.conf and resolv.conf file "blog.inlanefreight.local" but still not resolved. When entering the objective directly this load without problem, I mean the start page. but seeing the link where I understand that the target will be, I cannot resolve the host. Use vpn and also PAWN machine. in both change the settings several times. I also respawn on the target. I just can't resolve the host. or I think that's the problem. Any ideas?

[west canopy]

@true gyro check DMS

@deft ruin sent you a DM too brother 🙂

[raw saddle]

Stuck on the Web Attacks skill assessment. Every time I try to change a user password within settings and hit ‘submit’ nothing happens. Any ideas as to why?

[lethal atlas]

which module? part? question?

[hallow saddle]

Anyone for Firewall and IDS/IPS Evasion - hard lab?

[lethal atlas]

I passed that one.

[solar zodiac]

there is an IPS/IDS evasion module :O?

[lethal atlas]

yes, part of the Network Enumeration with NMAP module.

I am stuck on the Shells and Payloads module, Skills Assessment, Host-2. I know what exploit to use but I am either missing the targeturi, or the vhost setting. Anyone have any tips?

[lethal atlas]

what url did you come up with. It took me 6 steps to get the proper dir. DM me for some help

[thorny ivy]

Hi all. I'm stuck in the (hack wordpress) module in the last instance. I can't resolve the host of my target. (blog.inlanefreight.local) add to host.conf and resolv.conf file "blog.inlanefreight.local" but still not resolved. When entering the objective directly this load without problem, I mean the start page. but seeing the link where I understand that the target will be, I cannot resolve the host. Use vpn and also PAWN machine. in both change the settings several times. I also respawn on the target. I just can't resolve the host. or I think that's the problem. Any ideas?

[jolly jasper]

Hi, how are you? I'm stuck in that section and I can't move forward, I don't understand the question very well, what is this?
Login with the credentials (guest: guest), and try to get to the admin user from what you learned in this section and the previous section.
But I try to climb and can't find the flag

What happens is that I already tried to use what I learned in the section to find the answer to the flag and could not find it, since I thought that with the cookies when decoding them in base 64 a flag would come out but it was not the correct one and when logging in in The page left me another flag (being an administrator) and neither, and I had no idea where the flag is to pass that section, I do not know if someone could help me in guiding, in what steps to follow to get it, I would very much appreciate the help

[west canopy]

@jolly jasper check your DM's brother 🙂

@hallow saddle check DMs brochacho 😉

[thorny ivy]

hello me from the past! We solved this after two days but we finally succeeded. sudo nano / etc / hosts edit the file with (target's iP) tab (blog.inlanefreight.local) done! it is not editing the hosts.conf file or resolv.conf it is directly the etc / hosts path

[chrome hawk]

<@&861185840277487616>

[languid dawn]

👀

[crude quest]

hello can someone help me, im stuck at #OS exploitation of #sqlmap-essentials, couldnt find the another flag within the host. appreciate any guidance!

[stark tapir]

hello, thx i've done it, the problem was that i should type word "PORT", but not actually port number of spawned machine )

[gloomy tangle]

Hi! Noob help please. Can someone help with with the last skill assestment - wordpress? you can DM in needed (discord search button not working. thats why asking because maybe its already questioned) I am accessing LFI through site-editor but cant find the flag

I am adding ...ajax_shortcode_pattern.php?ajax_path=/home/erika/flag.txt but that is not the correct answer I suppose

[sudden fossil]

Does anyone know where I can download the Academy VPN from please?

I can't seem to find it anywhere

[rustic sage]

Not every modules need to connect with openvpn, either that or Docker that you have to deploy (IP:Port)

if you need a VPN key it will be given to you with the questions you need to answer

[lethal atlas]

has anyone done the shells and payloads module?

[oak vessel]

I have a question regarding the BugBounty Path, 3rd module, using WebProxies, section, webFuzzer, Zap Fuzzer. On the virtual machine in the browser, ZAP cannot be found/isnt installed. I attempted to install and or update the htb vm, to no avail. Is there a certain way I need to attempt to install zap or Do i need to create my own vm etc?

[unique valve]

DM me if you need some help still.

[round crest]

Hi! guys, I have a question does taking note important because I don't love to

[rustic sage]

It saves you a lot of time by not googling the same things everytime

[crimson path]

I'd say that would change per person depending how to learn and retain information.

but also that ^

[rustic sage]

• it helps you to build a metholodogy when you don't have one, tldr its up to you but really useful

[round crest]

I actually take notes when I am hacking but I don't love to take notes when I am learning

[rustic sage]

It's not mandatory to take notes on everything you're learning of course, only on what you think is useful / may be important to remember and/or use later for example

It really depends on you & how you learn things the most efficient way

(e.g if you have a really good memory or more a video learner or idk)

[round crest]

that good info man thanks

[crimson path]

If you find yourself going back to old modules 50 times when you're trying to remember something to use, you may want to take notes etc

[rustic sage]

+1

[rustic sage]

Anytime, even though I'm saying very basic stuff

but if it can help

[round crest]

I use sheetcheet all the time it's good for me because I know what I am searching for

[crimson path]

I have a cherry tree doc that looks like the crazy guy from beautiful mind went at'r

[rustic sage]

https://book.hacktricks.xyz/ is a very good one if you don't already have it

Obsidian ftw by the way

[crimson path]

Off to work- have a good day

[west canopy]

I went back and wrote documentation with screenshots for most of the modules i have completed and it's been a huge help

[round crest]

I have this HackTricks too. it's very good

[round crest]

you too man

[rustic sage]

[round crest]

https://anhtai.me/pentesting-cheatsheet/

[fiery cedar]

Hi, i guess i might need a hint. I am quite a HTB-Academy beginner and choose the wordpress module (Dont worry, i completed other modules before and got some pw cracking knowledge). I completed the module with reasonable ease (or so i thought), but now i am stuck at the Skill Assessment. I am failing to locate the wordpress parts of the website, i tried several things but i failed. I feel a bit bad asking for help tho haha.

[rustic sage]

Same with me, using wpscanner it said that it wasn't able to detect wordpress. Pretty sure its broken but I dunno.

[fiery cedar]

The problem is, that i am not really sure if it is part of the assessment 💀 😂

[rustic sage]

Yeah I don't think it is..

[glad cipher]

Hi, I have some problems with the module Setting Up, someone can help me?

[untold kiln]

We can try, what is the problems ?

[golden spruce]

hi i got a question about the getting started module and the section Public Exploits i don know wich exploit i need to search for to get into the Target Machine can somebody tell me the name of the Exploit or so and also i don know if iḿ supposed to be able to ping the machine but i can not so i don know if iḿ propperly connected

[fierce pond]

Hellooo

[golden spruce]

?

[fierce pond]

im a noob but let me check if i can help you with that

[fierce pond]

are you connected to HTB VPN ?

if you cant ping the target you probably are not connected to the VPN

[untold kiln]

First try to do a nmap on the target, that you learned in "Service Scanning"

The machine in "Public Exploits" is open to the internet, so you do not need VPN, but it will take some time to start up.

[golden spruce]

ok i guess iḿ not connected atm so iĺl work on that

but i should be able to ping the target right?

[untold kiln]

no, ping, but try with your browser 😉

[golden spruce]

and should nmap work?

[untold kiln]

Let me check to make sure ...

Is that "Nibbles - Privilege Escalation" ?

[golden spruce]

it is the question/Test machine in the Public Exploits section

[glad cipher]

How can I insert date and time in Kali Linux? In module 4 there is some script that i don't have in my machine

I can't paste the command here, but there is a PS1 variable definition that require some script, i don't have it and i can't declare the PS1

[golden spruce]

@untold kiln i need to find a public exploit to try out on the machine but iǘe already tried many and don t know how to search for the right one

[untold kiln]

No, nmap.

[untold kiln]

arh, ok, try and open it in your browser/firefox first.

[untold kiln]

When you say module 4 , do you mean at "Nibbles - Privilege Escalation" ?

[livid pier]

Hey all, I am doing file transfers, first module second problem, Upload the attached file named upload_win.zip to the target using the method of your choice. Once uploaded, RDP to the box, unzip the archive, and run "hasher upload_win.txt" from the command line. Submit the generated hash as your answer.

what did you use to upload the file?

[agile torrent]

sorry I could be kinda dumb, ive been waiting for a target to spawn for a while now, but its just stuck on 'Target is spawning'.
is there a way to debug this? thanks

[fierce pond]

just refresh the page and wait without pressing the button

it happens to me everytime i try to spawn a machine , it maybe because of the ad blocker or something on my end i didn't actually ask around if this is a problem everyone is having

[agile torrent]

neat thanks, i tried chrome (instead of opera) with adblock disabled and its working now

[fierce pond]

happy to help man

[dreamy galleon]

hi

[unique valve]

Hi

[uneven tree]

dm me if you still need help with that

[grave dust]

Hi, i'm doing the Skills Assessment - Web Fuzzing and I don't know why don't I get all extensions for all subdomains
||
ffuf -w /usr/share/seclists/Discovery/Web-Content/web-extensions.txt:FUZZ -w ext.txt:FUZZ2 -u http://academy.htb:31146/index.php7 -H 'HOST: FUZZ2.academy.htb'
||
the contennt of ext.txt is
||
archive
faculty
test||

But I do find the third one when i do :
||ffuf -w /usr/share/seclists/Discovery/Web-Content/web-extensions.txt:FUZZ -u http://faculty.academy.htb:31146/indexFUZZ||

[grave dust]

And for the last answer I gave the wrong wordlist but ffuf gave me some results (false ones)

[uneven ivy]

where are the docker instance for File Inclusion / Directory Traversal . how do i follow the examples?

[thorny ivy]

Hi

how are you?

are my messages displayed?

[thorny ivy]

hello! I'm stuck. #Cracking passwords with hashcat> section cracking wireless (WPA / WPA2) in the first problem. I download and extract the .cap file generated the .hccapx file with ./cap2hccapx.bin. I make this .hccapx file hashcat -a 0 -m 2500 to indicate wpa, then it used the rockyou.txt dictionary in addition to this I tried different rules of the hashcat directory several .rules until I created some custom ones. everything works fine only the scan ends and the cracking fails. I calculate that I have the wrong mode or for some reason the conversion from .cap to .hccapx fails somehow and so I cannot solve it.

[thorny ivy]

Solved!

[lethal atlas]

i havent figured out a way to upload without using rdp first.

[livid pier]

Even with rdp, I am having an issue becasue the box cant connect to the internet

[thorny ivy]

🥲

[strong spruce]

Hello everyone! I am stuck on the Knowledge Check exercise at the end of the Getting Started module. I am not able to gain the initial foothold. Would someone be able to help me out ?

[paper gust]

fyi 2500 is a deprecated mode

22000 is the current wireless mode

[scenic nymph]

Hello Im stuck on the SQL Injection Subverting Query Logic Question. Whats wrong here: Executing query: SELECT * FROM logins WHERE username='tom' AND password = ''or'1'='1'; I always get logged in as admin instead of tom

[thorny ivy]

Thanks yes, and in the tutorial show 1500.

[wet adder]

Is it normal in htb academy I can't reset my password since 1.5 month ? do someone can help me i paid 2 month...

[drifting knoll]

pls contact support

[wet adder]

Where ?

because nobody respond

[brittle jay]

can anyone help me with Toby htb ?

[paper gust]

yeah, I'm aware

working with the module creator to update all of that over the holidays

[lethal atlas]

once you RDP, you can start an python http server on your attack box to serve the file to the target.

[livid pier]

Thank you!

Ill give that a try

[rustic sage]

On the XSS module on the target page trying to add a comment is very difficult, it just doesnt let you comment. I have commented before but it took multiple attempts and i dont know how but I somehow managed to get it to start commenting. It seemed random.

[verbal mirage]

Hey all, I am stuck at the "Active Subdomain Enumeration" of "Information Gathering". I found the Nameserver FQDN and also the quantity of the zones. But I cannot get the contents of the txt record. They always show empty, no matter if I look them up with dig or nslookup. Am I missing something important?

[dreamy galleon]

Hi how are you

[muted kite]

So I've connected to ovpn and when I open up a second terminal to ping the target ip address it says destination host unreachable {continuous}

any ideas what im doing wrong?

[untold kiln]

Does the last line at openvpn says "Initialization Sequence Completed" ?

[muted kite]

yes it does, but than how do I continue to use that particular terminal without opening another?

it doesnt just stay put, its restarting every 5 seconds

[untold kiln]

the OpenVPN terminal, can not be used and must be open for VPN to work. So you need to open another one.

[muted kite]

sure, I tried that as regular user and as root user, it still cannot connect to the host destination

openvpn resets every 5 seconds could that be the problem?

[untold kiln]

you need to do "sudo openvpn xxx.ovpn"

[muted kite]

yes, its open

the terminal is initializing every 5 seconds

[untold kiln]

that sounds weird

[crimson path]

are you running a vpn on host or anything

[muted kite]

it says initialization sequence complete every 5 seconds

no im not running vpn on my main os

just in virtual box

linux

perhaps i need an update and upgrade?

[crimson path]

odd.. doesn't hurt to stay updated but check out the help faq for openvpn on the website and see if anything is applicable there

[muted kite]

im connecting on machines and starting point

do I only need one of them to be connected?

[crimson path]

on htb not academy? just make sure you're connecting to the proper ovpn for whichever range of machines/startingpoint/academy you're targeting

[untold kiln]

starting point has its own VPN connection

are you VM connected to the network by NAT og BRIDGE ?
Could be a security like IPS on you main OS that blocking/resetting it.

[muted kite]

im vm connected by nat

and I see that starting point and machine have two different ips

so i need vpn for one at time?

[untold kiln]

Yes

Only one VPN connection at a time.

[muted kite]

okay let me try it with machine so i can try to ping

[mellow ember]

I just want to say that the server-side attacks module is absolutely incredible. It has so much useful information. It adds in amazing info about bash scripting, python coding, exploit development, virtual environments to a treasure trove of info about the topic. It may be my favorite module from HTB academy. Good job guys!!!

[green turret]

Hey, guys! I just got into HTB and it's awesome! I got vip + in HTB and I'm wondering if it gives me access to HTB academy premium stuff too

Or I need to pay a different type of subscription? Thanks!

[drifting knoll]

HTB Academy is a different platform

[green turret]

Oh, I see. Thanks for the answer

[crimson path]

work through the 0 tier stuff just bouncing from module to module earning back the 10 cubes. great stuff

[mortal nova]

Is anyone else having trouble spawning the target in SQLmap essentials?

[formal vessel]

i had issues spawning an academy instance earlier

so i logged into starting-point to continue them

[livid pier]

I am

Are you on the tom problem?

[mortal nova]

I’m in attack tuning. Seems it’s working again though

[livid pier]

Can I ask someone about sql injection module, subverting query logic?

[burnt stone]

What browser are you using?

[livid pier]

Nvm I got it

[burnt stone]

Maybe try running in Incognito mode. That disables extensions and other stuff

[green turret]

Hey, guys, how can I scan/connect to a target IP like 167.99.95.121:31153

it's different from the usual ones

[muted kite]

do I have to register for the linux academy? it wont accept my current HBT credentials

[sterile hawk]

Yes it's a different account

[muted kite]

Okay, that makes sense now

[crimson path]

identify the port 31153 or whatever it may be, ip:port - which connection method could change how you will use it ie: ssh user@ip -p 31153 etc

[crimson path]

DM

half the fun though right

[shadow pendant]

can anyone help on last question of the wordpress module?

[polar bough]

Idk

[agile torrent]

the harry potter themed one?

[thorn glen]

Hi! Anyone finished the hashcat module? Got a weird situation with the last question in it (ntds.dit analysis), maybe someone could clarify what am I doing wrong? Thanks! 🙂

[molten barn]

Hey

Could someone help with the last question on the skills assessment on the active directory bloodhound module ?

[brave palm]

anyway im kinda confused on the "Attacking common applications" module. the OSTicket part is kinda unclear, it says to login with the corp email but where the hell do you find the password?

[cinder kelp]

Hello I think there is a bug in the Web Requests module in Fundamental. If you want to do the task "Request and Response" using Burp Suite, Burp Suite is not set and you have to configure the options yourself. According to the task you only have to start burp and the extension should appear in the browser, but this is not true. You have to configure Burp yourself and as a beginner is somewhat overwhelmed. I hope you can help me 🙂

[fierce pond]

HTB Academy is the BEST !!!

thank you guys for a very awesome materials and well done work on the learning methods you using !

[rustic sage]

Amen to that.

It's very similar to Jetbrains.

[torpid imp]

Module: attacking web applications with ffuf
Skills Assement last question.

With what list did. you get the value of the parameter?

[torpid imp]

Yes that is not good. I had this problem myself. There are 2 versions of burp suite. In one version there is a builtin Browser that works. I did. all exercises with that and it worked fine for me

[cinder kelp]

Oh cool I tried it and it works. I think in this case, only the task points should be changed. It should be pointed out that BurpSuite should be started instead of Burp and the builtin browser should be used instead of Firefox 🙂 Thanks a lot

[shadow pendant]

No not the kOTH room. I mean the Wordpress academy module. Stuck on how to get a shell

[junior hazel]

Hi, did someone finished the Brute Forcing module ? I'm stuck on Skills assessment

[torpid imp]

Module: attacking web applications with ffuf
Skills Assement last question.

With what list did. you get the value of the parameter?

Cans someone help ? You can DM me too

[lethal atlas]

sent dm

[fierce pond]

yeah i figured that but you can open the browser that related to burp suite and thank me after

[late cedar]

is it recommended to use HyperV as the Virtual Machine for Kali or should i stay at VirtualBox?

[fierce pond]

so its not set to work with firefox and the setup is not actually hard , but to save time just use the browser related to the burpsuite itself

[fierce pond]

exactly ...

[fierce pond]

i guess we are on the same path learning would you like to keep contact and maybe study together , would be fun to try , im about to finish the post requests and move to the next module

[livid pier]

Anyone having issues with the sql injections module? Most queries i try firfox says the 'connection was reset'.

[livid pier]

Nvm I am a smooth brain

[muted kite]

folks im in starting point with a question if anybody has the time to help me out. I would appreciate it

[trim scaffold]

I am not all the way through but I can try.

DM

[muted kite]

ok, im in starting point

[trim scaffold]

I have gone through the first two tiers, happy to help if I can

[crimson path]

Ditto ^

[muted kite]

im talking with a guy in #starting-point

come there if you can

[trim scaffold]

It looks like ToxDK has you covered.

[west canopy]

Can anyone give me a nudge on Linux Privilege Escalation "Privileged Groups"? The hint says to "Grep within the directory this user has special rights over". The examples provided in the section don't seem to match up with what is being asked. For example it shows unzipping of the file "Alpine.zip" while under user "devops" --- but when I ssh in as user "secaudit" I do not have the permissions to unzip it. Should I be looking for some variant of the find command to determine which directory "secaudit" has special rights over?

Edit: I have tried using the example find commands that were provided in the "Special Permissions" section.

[muted kite]

@trim scaffold So it says my scan is being blocked by host

any ideas what that might mean?

nmap -Sv

the regular ping works on the target machine IP

but cant get beyond that

I have changed my NAT to Bridged to try that and am still having issues

Im using Kali

[west canopy]

If it's an IDS blocking your probes then maybe try something like spoofing source port 53, or using -T0 for paranoid mode.

[muted kite]

https://redtm.com/docs/privilege-escalation/linux-privilege-escalation-cheatsheet-for-oscp/

I dont know much @west canopy but are you trying to open and write to a file? you cant save changes unless you are root user.

[west canopy]

ehhh i'm making some progress . Pretty sure they aren't asking me to follow the steps that they provided in the section , which seems unusual. I managed to extract alpine.zip by using chmod +x , but I can't use the lxd command against it.

Like i just need to find which folder my current user has special permissions over. I'm probably overthinking it.

[muted kite]

im not as far along as you

sudo nano {pathoffile}

thats about as much as I know about editing files, but perhaps thats not what you need to do

for instance I had to lookup steps and remove/add an app in the file and write out just to install discord on linux bullseye 11

[trim scaffold]

it looked like you got squared away so I had to go back to doing some work. Looked like you got through the machine. nice. be careful with your commands. Linux is very case sensitive. for example, nmap -sV -sC would be ok. -Sv would not mean the same thing.

[muted kite]

yes, its working now, he helped me figure out the problem I was having.

[trim scaffold]

thats great

[rustic sage]

i've been spending a long time on this but do u know how i could solve this, like where to start off at? "Try applying what you learned in this section by sending a 'POST' request to '/serial.php'. What is the response you get?"

[west canopy]

@rustic sage which module is that from?

Without knowing all the details --- I feel like you could probably use curl , or navigate to the page in your browser and use Burpsuite to Intercept the request and modify it to POST.

[rustic sage]

JAVASCRIPT DEOBFUSCATION

[west canopy]

@rustic sage check DM's 🙂

[fierce pond]

anyone around

i need help 😦

module https://academy.hackthebox.com/module/35

POST Method

Login with the credentials (guest:guest), and try to get to the admin user from what you learned in this section and the previous section.

i did that and i got a cookie but i dont know what im actually supposed to do with that , since i dont have any other username and password

i tried admin : password and it worked , im just wondering did i obtain the flag by accident or it supposed to be obtained like that , sound to me its pointless exercise , i spent 2 hours trying to figure something out and it didnt work , tried to use json and {"$ge":"0"}

that didnt work aswell

so if the whole exercise was about guessing i think i just wasted 2 hours for nothing

[west canopy]

@fierce pond about to send you a DM brother

[fierce pond]

why you need to send me a dm ?

[west canopy]

Because i'm full of spoilers

[fierce pond]

oh

[west canopy]

lol

[fierce pond]

dumb exercise

[west canopy]

yea in real life websites use https so its kinda pointless

but its also possible i'm missing something

[rustic sage]

Any chance I could get a hint with that same problem? I've been struggling with this one for way too long too.

[west canopy]

👍

[rustic sage]

Thanks for the help! @west canopy

[rich flame]

Does anybody know if the Into to Assembly Language course covers 64Bit Bof please? https://academy.hackthebox.com/module/details/85

[short vale]

On file transfer: How do I get the zip file to the parrot machine (to then upload it to the target)? The vm has no internet connection

I tried base64 encoding it and then copy to vm and decode to zip file but it smh didn't work getting an error when trying to unzip

Also when I base64 encode and then decode and encode again I get different output?! Edit: It worked after saving the b64 in a file and reading from there, pasting directly into terminal smh messed it up

[cinder kelp]

Sure ! DM me 🙂

[rose temple]

Hi. I need help with a single question from BROKEN AUTHENTICATION in Academy. I am stuck on the “Weak Bruteforce Protections” on page 5, question 2: “Work on webapp at URL /question2/ and try to bypass the login form using one of the method showed.” Hint: “This web server doesn't trust your IP!”.

I forged a X-... header and sent it using different IP, with BurpSuite and Curl. I also used the python script to no result. I don’t find anything. I went through other questions later in this module without any problem, I just need this one to finish. Please help!

[silk wave]

i havent started the academy because i created an account on the main hackthebox website and it doesnt let me create an account on the same email for the academy

by the way, does hackthebox work on wsl?

[short vale]

I think you can just login with your normal account

[silk wave]

i just restarted my account (deleted and recreated in the academy)

[rustic sage]

As long as you're connected with OpenVPN client on your host it should work

I didn't try

[silk wave]

does openvpn work on a windows pc?

windows 11 to be exact

[untold kiln]

Yes

[silk wave]

okay, perfect.

[untold kiln]

https://openvpn.net/vpn-client/

[rustic sage]

Yes it does

[unique valve]

Keep in mind that if you are connecting to any of HTBs networks from your personal system where you store your personal data there are penetration testers in training on the network. Its strongly advised to use a dedicated VM, computer or Pwnbox when learning with HTB and connecting to our network environments 🙂.

[silk wave]

I am using WSL.

[unique valve]

WSL is cool tech but it mounts to the file system in Windows so it has access to your files. Just be aware of that.

[uneven ivy]

can i ask a question related to academy here?

[drifting knoll]

sure

[uneven ivy]

challenge on Remote File Inclusion gives me an ip no port and i cant even ping the machine. what is the trick?

[drifting knoll]

File Inclusion / Directory Traversal module?

[uneven ivy]

yup

[drifting knoll]

make sure you're using Pwnbox or connected to the VPN

[uneven ivy]

vpn looks good from host.

[drifting knoll]

did you try to access it via browser?

[uneven ivy]

yes

[drifting knoll]

feel free to pm me

[uneven ivy]

is https supported on this ip?

[drifting knoll]

http works for me

[uneven ivy]

because ff redirects it to https

[drifting knoll]

check your ff settings, you most probably configured it to force https

[storm summit]

same here, i dont get it

[uneven ivy]

the pwnbox was able to access the web page. however something weird seems going on on my setup. because i dont see the trafic i should.

[vocal grove]

can someone help on Linux Fundamentals module? couple of questions system information are not making sense to me, they have many answers.

[vocal grove]

nv i just figure it out. i did not know that you have to ssh in order to answer the questions, the information you get from the pwnbox is not the right one .

[agile torrent]

Hiya, I'm trying to do the RFI section of the File Inclusion module, but am having trouble. I managed to get the flag using directory traversal, but I want to do it the proper way to learn. I'm trying to test the SMB protocol, but instead of the smbserver.py debug showing up like it does in the module, I get no output. Has anyone else had this happen? Thanks.

[agile torrent]

turns out the command I was using was a bit wack, this PDF helped a lot:
https://pdfhost.io/v/Hq5PEVrih_FileInclusionDirectoryTraversal
Thanks ^-^

[stark tapir]

Hi! Can you pls help me with Stack-Based Buffer Overflows on Linux x86 -> Generating Shellcode : " Submit the size of the stack space after overwriting the EIP as the answer. (Format: 0x00000)". After payload shell i have
0x5655557d <bowfunc+48> mov -0x4(%ebp),%ebx
0x56555580 <bowfunc+51> leave
0x56555581 <bowfunc+52> ret <----- now i am here, after this step will go to start of payload section in stack
And on this moment i have register:
esp 0xffffd0bc
ebp 0x810bb302
eip 0x56555581

And right after overwriting EIP:
esp 0xffffd0c0
ebp 0x810bb302
eip 0xffffd64c

How determene size of stack? ebp-esp (tried but answer is wrong)?

[broken saffron]

hello! Has anyone had trouble finding DNS module host x.x.x.203? I'm stuck in the module, I don't know which dictionary to use, I've already tried several and I can't find that host

any hint would appreciate it!

I mean the new module footprint DNS

[frigid vector]

Hey guys need a little hint in File Transfers module (Windows File Transfer Methods)

[frigid vector]

solved

[frigid vector]

Guys who could explain this (file transfers module):
Bash (/dev/tcp)

There may also be situations where no obvious file transfer tools are available. In this case, as long as bash version 2.04 or greater is installed (compiled with --enable-net-redirections), the built-in /dev/tcp device file can be used for simple file downloads.

Connect to Target's Webserver

Dm@htb[/htb]$ exec 3<>/dev/tcp/10.10.10.32/80

How I could use it? I don't understand.

[muted kite]

in the setup module is anybody here setting up password1 or anything else? I am under the impression that this is for security professionals who work for a company

[unique valve]

Hey would you mind clarifying your question?

[muted kite]

setup modules in academy teaches you what a security professional uses when working for a corporation

[formal vessel]

That remote file inclusion was fun 🙂

[muted kite]

I guess maybe its really just a matter of choice

[unique valve]

Absolutely. There are various setups security pros can use for the work they do. My setup is VMware esxi server where I use different vms for testing and learning. Others use containers more than vms, some make use of cloud environments and many try using a mixture of all of them.

[muted kite]

so than the setup module is just knowledge based to show a security professional the different avenues that they can use, but for learning purpose. Should I set any of those up in my VM even though I don't currently hold a position in a corporation

? @unique valve

[distant stream]

dm if you are still need tips

[unique valve]

Absolutely! Thats one of the great things about this field. A lot of the technology is accessible and affordable even if you dont work for a corporation.

[muted kite]

Okay well perhaps I will see what I can work in there

[crimson path]

Did you figure this one out? Shoot me a dm

[neat kindle]

Hey everyone, did anyone do the "Attacking Web Applications with Ffuf"?

I'm stuck at "Skills assessment" where task is to find a page with the content: 'You don't have access!'

I'm tried: ffuf -w /home/kali/wordlist/common -w found_hosts:HOSTS -e .php:,.phps,.php7 -u http://HOSTS:32765/FUZZ -recursion -recursion-depth 1 -fc 403 | tee subdirectories

I also don't understand what the hint is supposed to mean? Am I supposed to try all 65535 ports? This would literally take years.

If someone could give me a hint, that would be absolutely amazing

[muted kite]

im not doing that module yet, but I think there is a command whereyou can run 1000 ports by a range at a time @neat kindle

[west canopy]

@neat kindle hey bud i'm gonna DM you in a sec 🙂

[muted kite]

In setup it's working through security OS in vmware, I setup VB with Kali Linux, do I need parrot os instead to proceed with the academy or can I use Kali Linux?

[west canopy]

@muted kite i personally use kali with no issues

[muted kite]

ok, so great, sounds like its personal choice

[untold kiln]

Parrot, Kali, BlackArch, they all can have the tools you need, so it is just a matter of look, feel and preference ...

[unique valve]

You can even make your own by starting with a distribution of Linux and adding tools to it. People also have turned Windows into a pentesting system: https://github.com/mandiant/commando-vm

[untold kiln]

Wow, gotta try that 😄

[unique valve]

Its pretty cool. You start with a windows 10 install and then run the script they have in that Github repo. The script installs a bunch of tools, its cool to watch it work.

[untold kiln]

well there goes the xmas days

[untold kiln]

But you should defiantly try different distros to see what they feels like. and it is pretty easy as a VM.

[muted kite]

I think I will, but perhaps not straight away

[untold kiln]

Always nice to have a todo list 🙂

[muted kite]

I downloaded the windows 11 VM and imported to my virtualbox. Do I need to reconfigure the settings? There was a hyper link provided, Im guessing it's not configured the way is necessary

[muted kite]

none of the commands are recognized in the windows11 virtual machine I just installed

I'm in the setup module. Perhaps I will skip it for now.

anything that costs money to do, i'm not doing right now, will this prevent me from moving forward in HTB academy?

[muted kite]

Crickets

[crimson path]

Eventually, once the tier 0's are complete you'll probably have 40 cubes. From there the cost of cubes rises and the return lowers so there would be cost.

[muted kite]

I means like setting up vps, password1

Services that cost money every month

@crimson path

[crimson path]

Oh well then no you shouldn't have to spend anything you don't want to spend

[velvet sparrow]

DM me.

[shadow verge]

I'm having problem with finding foothold on the LFI final section box, I have had some progress, but not enough is there any tips?

[muted kite]

Is this free vps service?

The one recommended by HTB costs money

[muted kite]

i think it requires a web domain, not sure thats the correct one

[rustic sage]

I am having some problems with hack the box can some one help me

[worldly grotto]

Hello i dont understand how i can create the wordlist rockyou with 2020 at the end of each password in the list. Can you help me please ?
module : CRACKING PASSWORDS WITH HASHCAT
section : Working with Rules

[west rampart]

@muted kite i deleted the link since i don't trust a random 'get a Free VPS' Website

[sudden shore]

hey is this where the academy modules are being discused?

if so, INTRO TO NETWORK TRAFFIC ANALYSIS on the question " Given the capture file at /tmp/capture.pcap, what tcpdump command will enable you to read from the capture and show the output contents in Hex and ASCII? (Please use best practices when using switches)" cant get it solved and the obvious switches are -X for hex and ascii and -r for reading the pcap file, so final answer would be -Xr /tmp/capture.pcap

but no, wont work, obviously tried playing with both switches like mb they're in a diff order but nope

[rustic sage]

You can discuss it here and #858470491676737536 if you think there is something wrong with the answer

[muted kite]

No problem, neither will I than.

[main vapor]

@worldly grotto DM me.

[west canopy]

@sudden shore check DM's 🙂

[unique star]

Did you figure it out? I'm stuck with that question too. Any hint?

[main vapor]

@rough pelican DM me.

[supple gyro]

Doing the Linux fundamental course and when I try to login into the SSH it keeps saying permission denied even though I'm 100% putting the password in correct

Any tips?

Nvm got it

[frank forum]

I'm stuck in "web requests -> POST method". I don't understand what is the answer supposed to be... the cookie?

[rustic sage]

Can you send a ss of the full question?

is it the one with num1 num2 by any chance ?

[rustic sage]

I don't remember what kind of answer it expects, try with the cookie yes

or maybe a flag once you're logged in as admin

[frank forum]

I tried multiple things, but it doesn't seem to work

[drifting knoll]

pls be careful with spoilers

[frank forum]

okay, sorry, but I mean, it doesn't work

[crimson path]

I'll DM ya we can try to walk it through

[rustic sage]

I can't log in to HTB rn so not able to help further, sry

[livid pier]

In intro to network traffic it says' Utilizing TCPDump-lab-2.zip in the optional resources, perform the lab', where are the optional resources?

I found it, smooth brained

[west canopy]

@frank forum about to send you a DM bro 🙂

[scenic swallow]

Hey everyone. Just to test how things work I'm sending this msg. I'm new to hacking and much newer to discord. Any suggestions would be greatly appreciated. Merry Christmas. Cheers.

[frank forum]

solved it. I was having problems because of a trailing '\n'

[west canopy]

@scenic swallow welcome!

[agile torrent]

did you end up figuring it out?

[shadow verge]

No still have not figured out,, not yet tried because of the christmas either ^^

[agile torrent]

all good, sorry for the ping

[shadow verge]

np

[paper gust]

you need to make a rule to add 2020 at the end

hence the name of the challenge

[west canopy]

@worldly grotto sending you a DM 🙂

[worldly grotto]

Thanks

[chilly marten]

I checked all the directories but wont be able to find the another flag

Its in the Using web proxies module in bounty hunter path

can someone please help me where the other flag might be hiding since I can only find one

[hot shadow]

you should deploy a reverse shell

and maybe privilege escalation to root

idk

[chilly marten]

but that module is literally just proxy tutorial

and its stated as easy

[hot shadow]

oh probably just search for other files named flag

it's probably just hidden

[chilly marten]

.........

[hot shadow]

find / - type f - iname flag2.txt

btw what is that machine?

[chilly marten]

thats the module named using web proxies

and its the repeating requests section

[hot shadow]

oh okay

can you send me the url

i think i haven't done that yet

nvm i got it

[chilly marten]

even with the ls -a that should also show hidden files I only see 1 flag

[unique star]

Try to search in other places

[chilly marten]

nvm I found it

it was just in the root directory 😭

[hot shadow]

what did i tell you

it was hidden

[chilly marten]

I thought it would be hidden in the sub folders lel

[hot shadow]

i always take a look at the root folder

[hallow saddle]

In SQLMap final_flag skill assessment, I found the injection point and got the banner. However, dumping DB is failed. any hint

[low dirge]

File Upload Attacks: File Upload Attacks. Appears to be bugged as not even SVG files can be uploaded. Does anyone have the same problem?

[boreal junco]

Good afternoon everyone

I'm new here, and already asking for help beacuse I'm stuck in first exercise of module "web request"

Send a GET request to flag.php with two parameters num1 and num2 such that their sum is 1337.

And stuck as well in second

Login with the credentials (guest:guest), and try to get to the admin user from what you learned in this section and the previous section.

[rustic sage]

For this one look up on Google how to put parameter using cURL

[boreal junco]

I did it, but I keep face the error screen

[rustic sage]

Which one ?

Send me your full command

[gleaming cosmos]

@rough pelican I did this module long time ago but I can try help 🙂

[rustic sage]

Hi, I'm new to both HTB academy as the HTB discord server. I can't verify with the bot, not a HTB identity, is that correct?

I came over here because I lost my spawn about a copy-paste issue in the first interactive section 😦 wasn't able to paste the spawned URL into Firefox. I'm on Firefox IRL; does HTB academy have issues with FF? Should I better use Chrome or some other browser?

[cinder kelp]

Module Name: Getting Started
Section: Privilege Escalation
Question 1: SSH into the server above with the provided credentials, and use the '-p xxxxxx' to specify the port shown above. Once you login, try to find a way to move to 'user2', to get the flag in '/home/user2/flag.txt'.
Quesdtion 2: Once you gain access to 'user2', try to find a way to escalate your privileges to root, to get the flag in '/root/flag.txt'.

I search for vuln. and find a little bit but nothin that gives me acces to user 2 ? 😦

Can someone help me pls ?

[main vapor]

Did you do the most basic of the basics, i.e., ||sudo -l||?

[cinder kelp]

Yeah i change to user2 and stuck with the priv. escal.

[west canopy]

@cinder kelp about to send you a DM bro 🙂

[cinder kelp]

thank you for the hint ❤️

[patent sinew]

On the brute force skills assessment - service login

Is the employee user list the same one from the prior examples for bill gates?

[next bane]

how can i get the ovpn file??

[unique valve]

In HTB academy modules you will see a button at the bottom of a section that has challenge questions. Feel free to DM if you still run into issues with this.

[uneven ivy]

can i have a hint for File Inclusion / Directory Traversal assessment?

[agile torrent]

what part are you stuck on?

[uneven ivy]

not sure what should i do from now on. I have tried most of the things i found in the previous modules but none seems to work

even so,i think i know what parameter can be exploited but i cant figure it out

[muted kite]

so far I dont like how the academy is structured, I like how starting point is structured comparatively.

[unique valve]

What do you wish academy had but doesnt currently in terms of how its structured?

[muted kite]

I think it makes a lot of suggestions but not necessarily step by step guide on configuration. I know the internet has a lot of how to information that makes up for that, also some of the commands are not recognized and there is not really a guide for what to do when errors occur.

needs 'common issues and how to fix them'

i know that their are forums, but response times vary

[unique valve]

What errors or issues have you been experiencing recently?

[muted kite]

When I setup windows in VirtualBox none of the commands worked. I'm not sure if this is because the guide was created for windows 10 and windows 11 sucks and it's what I downloaded

or if perhaps I didn't configure the VM correctly in the first place

I have linux on VM and it works well, the windows 11 VM I have not been able to download chocolately package manager or anything else, the commands are not recognized

I'm not here to complain, its stacked with lot's of knowledge. Maybe I am just overwhelmed

[unique valve]

No you are fine. Feedback is always welcome. Theres always room for improvement. Are you ok with moving to DMs? I may be able to help with the issue you are running into.

[muted kite]

well, im on the wrong side of platform for this, i'm in windows and I will have to move over to my linux side. Can I DM you later after I finish this and get over to my linux side?

[unique valve]

Sure. Feel free to.

[muted kite]

okay great.

[patent sinew]

On the brute force skills assessment - service login

Is the employee user list the same one from the prior examples for bill gates?

[muted kite]

so apparently im stuck in the fear zone and i also have a low frustration level.

[west canopy]

@patent sinew about to send you a DM brother

[agile torrent]

i got stuck on this yesterday, the correct port is in the list it returns. try running a version check on them to find which one is telnet

nice nice

yea running version checks on all 60000 something ports is going to take a while 😅

xD

usually I use a normal nmap scan to pick up the open ports, then run the scripts on those specific ports with -p 22,80,443 etc

helps speed it up a wee bit

[uneven ivy]

i just finished the ilf challenge. but there is something i dont get. Can i pm to someone?

[agile torrent]

dms are open if u need

[copper creek]

anyone for a nudge on footprinting module/dns finding the fqdn of the host with last octet .203?

[drifting knoll]

you have to find all zones

[copper creek]

and I get the zones with dig axfr domain.local @ip ?

[drifting knoll]

i suggest you to reread the section again carefully

[copper creek]

can i dm u?

[drifting knoll]

feel free to do so

[copper creek]

big thx to Cry0l1t3 for taking his time and explaining it to me so I understand this 🤗

[short vale]

On File-Transfer module, can someone explain to me what is the intended solution for windows file upload? I solved it but was more like a workaround

[tepid peak]

I downloaded it from my local machine, can't remember the exact method but I don't think it can be considered 'unintended'

[patent sinew]

On the shells & payloads live engagement host 2, after uploading the exploit from exploit-db and running the exploit it says

Exploit failed: NoMethodError undefined method ‘split’ for nil:NilClass’

[muted kite]

In Getting Started Module > Basic Tools > tnux what is the 'prefix' I see the 0 in the lower left bottom corner from hitting CTRL +B but I can't see a response from any of the other terminal related controls

"tmux"

[midnight basin]

hello im new to discord how do i listen to the podcast

[urban sage]

I haven't done that module but pressing ctrl+b should then tell tmux to treat the following key press as a command. So to create a new windows press ctrl+b then let go of those two and press c.

[muted kite]

I'm going to watch that video by ippsec

[urban sage]

Not sure about a podcast. The closest I know is a series of interviews that can be found on the HTB YouTube channel. https://m.youtube.com/playlist?list=PLvrX-Ob08KZLvmIdqKM7KzJEw3QoKiHHo

[muted kite]

ippsec for tmux video is going way over my head

[short vale]

No I mean the File upload, it says upload first and then rdp, but the commands explained for upload are bitstranfer and invoke-restmethod with base64 encoded payload but I don't understand how it would work if nothing is listening

[short vale]

most of the time you will just create new windows and switch between them or split windows

[muted kite]

Yeah, I dont mind just using the regular terminal, I used terminator about a year ago and it worked fine

this guy is on another level with the terminal and he moves so fast I can't keep up, I have been watching him in awe.

[muted kite]

Oh I get it now, I was trying to use the command to capture the banner on my virtualbox linux machine, but the netcat command didnt work, i'm supposed to test it in the instance]

I have to pay money for more instances

[coarse inlet]

Got a weird one here I think -

On the module Using Web Proxies. The ZAP Scanner page specifically.

When I use the zap scanner on the target host I should get a high level vuln, but I only get a few mediums and loads of lows.

🤔

The question for this section thinks there should be a high level vuln that I use to read the flag under /flag.txt

[muted kite]

Im in Academy>Getting Started>Service Scanning on Page 7. I am connected to the academy VPN key however I cannot connect to the target machine ip address listed in the exercises, I am attempting the command in the terminal of my virtualbox VM. Any idea what the problem is here?

[gleaming spindle]

Hi community i'm having troubles figuring out what to do in the section: "Firewall and IDS/IPS Evasion" from the module: "Network Enumeration with Nmap" any help will be great

[west canopy]

@muted kite maybe try using the in browser pwnbox and see if the issue persists?

@gleaming spindle easy, medium or hard lab?

[gleaming spindle]

@west canopy thanks for the answer, is the medium lab where I'm having troubles

[muted kite]

@west canopy I'm using free version right now and I already used my free instance for the day. I was under the impression that a VM connected to ovpn should allow me to target the target machines ip either way

[west canopy]

@muted kite This might sound silly but i would try restarting the VM and re connecting to the VPN if you haven't already. i have run into weird issues using virtual machines and have to reboot quite often.

[muted kite]

i just did a reboot of the virtual machine. Im going to try sudo kill all openvpn now

[west canopy]

@coarse inlet about to send you a DM bud 🙂

[muted kite]

that did nothing

[west canopy]

shoot sorry bro 😦

i will try it on my end here in a few minutes

[muted kite]

im a fool, i was trying to use the target ip in the text file instead of spawning my own at the bottom, that was the problem

[west canopy]

lol nice

[muted kite]

so the first question says: Perform an Nmap scan of the target. What service is running on port 8080? (two-words) I have typed variations of 'Http-Proxy' but it says incorrect answer

Im positive that this is correct as I also verified on nmap website

Also I am running an nmap scan -sV -sC -p- and it's been about 15 minutes with no output yet, is that normal?

This platform is difficult to work with man.

NM, I was wrong, I had to wait for the second scan to come back

[west canopy]

Using -p- will have nmap try and scan every possible port so typically it takes forever .

[muted kite]

right, i realized that only after i typed that in

[muted kite]

im still stuck downloading seclist which is slow in virtualbox

I might know here pretty soon though RohitM

while i'm waiting am I supposed to do 'nano /etc/resolv.conf and add dns server before using the 'gobuster dns..' command or is that one and the same?

like dnsserver 1.1.1.1 and than write out?

@vital echo

sudo nano /etc/resolve.conf

so

dnsserver 1.1.1.1

and write out?

or nameserver 1.1.1.1

doesnt seem to work either way

let me try it

its case sensative SecLists is actually 'seclists' and now everything else seems to have worked up to this point

also must include that port along with the target IP address or nearly nothing works

[muted kite]

ok so im in Getting Started Module>Public Exploits and after setting RHOSTS and RPORT I'm receiving an SMB login error while connecting to the IPC$ Tree so I can't run the exploit

ive tried it many attempts and its not working, i found content on google, but that didnt work for me either

[muted kite]

alright I got the flag, that one was tricky

[patent sinew]

On the LFI assessment I was able to get the source code and found the php script. I can’t figure out where to go from there.

[muted kite]

sorry I'm about to begin Types of Shells. I believe you are in a more advanced module

[rustic sage]

Hello , I have started the Linux Fundamentals course and I'm at the User Management section. And in the one of the questions they have asked " Which option needs to be set to create a home directory for a new user using "useradd" command?" and to which I tried several commands and it's showing me incorrect. Also there is no format or hint provided. Can anyone help by giving me the format? I tried sudo useradd -m -d /home/username username

[rustic sage]

The answer is the switch used for that, not the full command

Oh yes. My bad. Thank you 👍

Np, anytime

[prime meadow]

Does someone can help me on footpprinting medium machine ? I've found sommething but i can't figure how to use it...

[drifting knoll]

@boreal junco pls be careful with spoilers

[rustic sage]

Did I get ping

[boreal junco]

@drifting knoll sorry

[drifting knoll]

thx for the ping..

[boreal junco]

@rustic sage did you see what send to you?

[rustic sage]

No Cry0 deleted because of spoilers I guess, what it was about ?

[boreal junco]

Hmmm

Can I get in touch with you in PV?

[rustic sage]

Sure

[boreal junco]

I can't

For some reason my actions are being limited

😫

[rustic sage]

Check your confidentiality settings

I've disabled friend reqs but messages should be good now

[boreal junco]

Ok..I'll try

[rustic sage]

I've sent to you a friend req, it'll be easier