modules

[rustic sage]

Hello

Guys I need help with Parameter Fuzzing - GET

[naive aspen]

*** EDIT - Just found it. Failure string was the issue. ***

Login Brute forcing web assessment - question, is it the same 'user'name as question and is the password in the password file specified in the cheatsheet? The scan has ran over 200K passwords and still not found it. Do I need to look at me failure string?

[little whale]

Please see your DMs for instructions on how to verify your HTB account.

[meager lynx]

Hi, not sure if this is the right place for this, but: Im trying to learn and getting into cybersec. I started TryHackMe, but switched to HTB since companies mention HTB in their job listings from time to time. So I started Academy, and the Jr Pentest Path, but since it wasn't 100% complete with lots of -coming soon- modules I went for the Cracking into HTB-skill path instead. And since I already started I had the Getting Started-module so I continued that one. Anyway, some things seem a bit out of my current knowledge. Am I approaching this the wrong way? Should I do every fundamental module first, then easy, and so forth? Or should I stick with paths, and do the module/boxes that are mentioned on the way? (sorry long message)

[glad orbit]

@meager lynxI had the same problem as you.
I started by starting from the basic modules that offer interesting ideas and topics and then moving on to modules with a more demanding level.

[meager lynx]

@glad orbit That sounds good. I'm glad im not along on this one. It so much new stuff. I thought I was kinda well versed, but clearly not. So much is new: Linux, ftp, ssh, etc. So finding good external sources on top makes my head spin a bit. I guess google dorking might be a good start 😛

But there are some lightbulbs that switch on every now and then. And thats so much fun!

[keen nebula]

can someone help me get my account verified in this server?

This Account Identifier does not appear to be the right length (must be 60 characters long).

dats the error im getting

[alpine summit]

Hey guys. I need help at password attacks module. Can anyone help me?

[lucid mirage]

DM me.

[steep sable]

Any one managed the last flag for vHost task within the INFORMATION GATHERING - WEB EDITION module? I have the flag, but it says its incorrect

[alpine summit]

Make sure there is no space at the end when you copy and paste. I've had this happen before.

[lethal atlas]

happened to me a few times as well.

it is also possible to find a flag that is for another section. Happened to me yesterday

[tiny ledge]

Can someone help me with this one: Submit the FQDN of the nameserver for the "inlanefreight.htb" domain as the answer. - the website doesn't seem to exist and the IP address provided gives apache default website

This is from the: INFORMATION GATHERING - WEB EDITION

[steep sable]

I made sure there were no spaces, but it seem that I used the same flag twice. I need to find the last flag from the vHost starting with "d"

[acoustic owl]

You can query the name of a nameserver with dig NS domain.tld @ipofdnsresolver

[steep sable]

look at the dig command in the cheat sheet

[alpine summit]

Unfortunately, he couldn't help me. Wrong module. If someone can help me. The module is Password Attacks.

[tiny ledge]

worked, thanks!

[lethal atlas]

you can dm me and I will help

[tiny ledge]

Damn this 'Active Subdomain Enumeration' part is rough

[lethal atlas]

yes it is.

[odd shore]

I've been stuck on this module too, where are you?

[alpine summit]

I’m stuck on Password Mutation and Password reuse because you must have the Password of password mutation and Credentials on Linux

[distant stream]

Dm

[prisma knoll]

Hey, I'm on module Login Brute Force, section service authentication, found the first flag, managed to connect to the first user with ssh but can't find the second user ftp access, used several lists, the one I generated for the first user, the one that was in its directory, and some other common known list but nothing seems to be working, anyone would have a hint for me pls?

[west canopy]

@prisma knoll you will want to run Hydra from inside the target, against the loopback IP address using the rockyou-10.txt wordlist that is on there.

[prisma knoll]

oooh damn

will try that right now thanks !

[steep sable]

could someone give some tips on the Active subdomain Enumeration? My txt record shows nothing

[lethal atlas]

dm me

[livid pier]

LETS GET READY TO RUMBLE

@lethal atlas @west canopy Good morning and happy friday!

[lethal atlas]

what up @livid pier

[livid pier]

Whats good bruh, getting back to that mod grind, just got a freshie

Binaries kill me on these boxes

Im looking to change all that🤣

[lethal atlas]

hell yeah. Im almost done with the bug bounty path. Just gotta finish web attacks I think.

[blissful verge]

something about writing about AD with @mellow whale and @unique valve that get's me pumped on a Friday 😉

[west canopy]

https://tenor.com/view/friday-rebecca-black-weekend-gif-21133470

[livid pier]

Is this a hint about the next mod to drop?

[west canopy]

Sysadmins hate him! Learn this one secret trick to get Domain Admin.

[late beacon]

The supplied password list doesn't work for the "Credential Hunting in Linux" section of Password Attacks

[distant stream]

why not try the mutated one?

[late beacon]

Not working either. Did you figure out this one?

[livid pier]

The breaking passwword mods is killing me

[distant stream]

dm

[brazen warren]

Nginx Reverse Proxy & AJP ServerSide Module. I cannot setup the proxy/nginx on the pwnbox but to complete module i need to know Tomcat version. Anybody can provide answer? Answer format: X.X.XX

[west canopy]

@brazen warren I struggled for a bit on that section . DM me and i can send you my nginx.conf file.

[brazen warren]

so yeah it was nginx issue, after replacing it worked like charm, thanks!

[native flicker]

I don't know if I'm missing something REALLY obvious, but:
Web Requests Module, first part (HTTP)

Every target machine that I spawn is unreachable. I can't curl the webserver at the provided port, I can't ping the IP address, I can't access it via browser. Both when I try from within the HtB network on my VPN and outside of it. Any thoughts? Maybe just a temporary issue?

[acoustic owl]

Did you use the Academy VPN?
https://academy.hackthebox.com/vpn/key

[wintry gorge]

This happens to me occasionally as well, be sure to refresh the module page before spawning the instance. That usually helps, and then wait 1 min before probing the ip and port. Also check that you are connected to VPN if the lab requires it, some of them do and some of them don't

[versed zealot]

Are you including the port number in the URL?

If it spawns with a port it's a docker target and is only accessible at that port.

[rustic sage]

Can I ssh to the htb-student on my own Kali instance in virtual box nothing seems to work out just times out

[kind turret]

@rustic sage DM me.

[true tendon]

anyone know why ffuf is suddenly so slow? on both my own kali vm and the pwnbox, ffuf initially is able to do thousands of requests per second, but soon can only do one per second, and the issue persists after multiple resets as well

[rustic sage]

@true tendon yes i had that issue before so i sometimes refresh the pwnbox and re assign the hosts too

and it should work

sometimes i noticed the arguments are kinda messed up by stupid me but once fixed it's all fuzzing fast

[inland elm]

hello guys how can i find a box in which i need to crack a password? but for beginners and free

[rustic sage]

Hello, I'm stuck in Skill Assessment of Server-side Attacks. Without registering an account the application does nothing.

[rustic sage]

Yes I do. Sometimes I find it easier to be on my own machine.

[acoustic owl]

Take a close look at the source code

[rustic sage]

Yes I finally did it, thanks.

[winged roost]

hi, all, I wondered if it was possible for a nudge in regards to: Web gathering module, active sub domain enumeration - on face of it i seem to be everything correct, but cannot answer the question... so obviously ive taken a wrong turn somewhere.

[tacit topaz]

Hi all, I'm dealing with the skill assessment service of Login Brute Forcing, the question say I have the name of an employee but I don't... It might be what I find in the previous skill assessment but that doesn't work... Anyone can help me ?

[tacit topaz]

Nvm, I find it... I took a break retake from the beginning and I got it

[modest moth]

kind of stuck on the assessment for file upload attacks. i was able to read the source code of the uploads.php. i found out the naming scheme and location of where the files i upload go to. However, im kind of stuck at making a payload to get a simple webshell. can any one nudge me in the right direction? i found 2 potential file extensions that can allow me to send a payload

[lucid mirage]

try to bruteforce available extensions

[zealous fiber]

Hello guys, stuck on the Predictable Reset Token Question 2. I got the encryption algorithm but how should I forge a password without knowing it. Tried it with prefix rockyou and with the htbuser password. Anyone a little Hint?

From the Broken Authentication Module*

[west canopy]

@winged roost feel free to DM me 🙂

@modest moth DM me too dawg

[modest moth]

literally just got it!

[west canopy]

nice!

[modest moth]

had to think outside the box on this one

had like 3 repeater tabs in burp open.

i was tripped up because after brute forcing possible extensions, i got .log and .reg are valid ones. so i spent like 2 hours reading up on those file extensiosn and seeing if they can send payloads lol

i def learned A LOT

oh, and learned about changing hex signatures to trick a whitelist into accepting a file type.

[zealous fiber]

Nvm found it, If you read carefully its easy lol 🤡

[devout cliff]

hey all, im working on the skills assessment part of cracking passwords with hashcat and im on the last step 'After cracking the NTLM password hashes contained in the NTDS.dit file, perform an analysis of the results and find out the MOST common password in the INLANEFREIGHT.LOCAL domain.'. At this point with the file provided in the module, should i be extracting the hashes from the file and then cracking or can I crack the hashes as is?

[livid pier]

I think it is the second option

You can feed hashcat the whole file

[devout cliff]

so when i do that im getting a token length exception error in hashcat

[west canopy]

@devout cliff You just want to run hashcat against the provided .ntds file . But will need to add a few options to make hashcat crack the same hash multiple times (by default, once a known hash is cracked it's added to the potfile and won't crack it again)

[devout cliff]

the module says its NTLM so thats the mode im using, but its not taking it

[west canopy]

-m 1000 should work

[devout cliff]

ok so it doesnt throw me an error when i use that mode so thats great but its also exhausting the list. so the options the module talks about i believe i understand via the hint its giving, but even if i dont use that option it should give me some hashes back on the crack i just did, but it doesnt.

[late beacon]

Anyone do this one? (Password Attacks)

[livid pier]

--show

@devout cliff Send a screenshot when you initialize and start the crack

[lyric mason]

What did i do wrong?(Getting Started ,Question:Try to identify the services running on the server above, and then try to search to find public exploits to exploit them. Once you do, try to get the content of the '/flag.txt' file. (note: the web server may take a few seconds to start)

I did got the flag.txt add cat it

[devout cliff]

@livid pier PM'd

[late beacon]

These Password Attacks modules are very time-consuming, not sure if I'm on the right track

[west canopy]

@lyric mason try navigating to the target in your browser, you should see a certain Wordpress Plugin being used and you will want to find an exploit to target that

[tribal linden]

Anyone free to give me a nudge with the Web Service & API Attacks module. stuck with the file upload with RCE, I have followed the instructions and have super limited RCE?

[west canopy]

@tribal linden is that from the "Arbitrary File Upload" section?

[tribal linden]

yes

[west canopy]

This might sound stupid but definitely double check your backdoor.php file. It took me three tries to get it right because I kept having typos in my script.

[tribal linden]

the weird thing is i do have some RCE, like i can execute which python and get a response but little else works. I will double check it all

[west canopy]

Yea that's weird. So i was uploading my backdoor.php file then running web_shell.py against the target. And it looked like I had RCE but when I ran commands I would get no response whatsoever

[distant stream]

dm if you need help. They really time consuming...

[lyric mason]

Oh , i will try it , thank you for helping.

[unreal sigil]

Academy > Cracking Into HTB > Getting Started > Privilege Escalation

kept trying password1

[west canopy]

@unreal sigil try doing user1@134.209.28.38

[steep sable]

anyone done the Skills Assessment - Using Web Proxies. Need help with the last two questions

[unreal sigil]

seems to have worked, thx

[west canopy]

@steep sable i got you dawg, DM me 🙂

[dusky briar]

m

[unreal sigil]

this keeps happening

I've tried closing, reopening, refreshing, terminating, restarting

keeps happening

[summer shoal]

yeah so i think the VPN service is down cause i had issues pinging VMs

[unreal sigil]

oh ok right on thx

[summer shoal]

yeah connect to HTB is red on the site

so i can't do the starting point vms

yeah, site went down, i got kicked

[unreal sigil]

idk I'm able to start a pwnbox on htb but still doesn't connect to target

[summer shoal]

let me try connecting again

i'll go over port 443 tcp this time

woo! got a reply

[blissful verge]

@unreal sigil I noticed there was not a pwnbox in that Privilege Escalation section. I added one. can you try spawning the target in that section + a Pwnbox and try again?

[west canopy]

@unreal sigil for me personally sometimes i need to spawn Docker targets a few times before I can connect or interact with them

[unreal sigil]

yes I had tried spawning several times and kept getting that same result

tried some more now but it's still happening

[unreal sigil]

guess I just had to say yes

[summer shoal]

I apparently can't get on the unika.htb site for responder

i've added it to my hosts file

i restarted NetworkManager

[west canopy]

@summer shoal you may want to try asking some of the folks in the #starting-point channel

[opaque fiber]

academy > getting started > what's next > Knowledge check I am stuck on the first alone box. I got a www-data shell but only the cat command work so I can't escalate privilege. I could get the user flag with it though I did not gain access to that user. Running rockyou against that ssh user at the moment

[west canopy]

@opaque fiber Are you familiar with GTFOBins? Try doing sudo -l

[opaque fiber]

suso -l fail "command not found"

[west canopy]

are you typing suso or sudo?

[opaque fiber]

sudo

echo fail too

only command that work are ls, cd and cat

can I pm you the exploit I used? it might be the issue. I don't want to spoil though

[west canopy]

yea DM me

[proud sparrow]

hello guys, idk how to do it, im in USING WEB PROXIES module so im answering the question and i need to use ZAP tool for intercept request, but the off/on break button doesn't work, i cant make the intercept, what should i do ?

[west canopy]

@proud sparrow not sure which section you are on but for the "Zap Fuzzer" section i just ended up using Burpsuite

[rustic sage]

Why can't I post in general?

[proud sparrow]

@west canopy its Intercepting Web Requests section and all the section talks about using zap

[west canopy]

Yea I used burpsuite on that section too. I only used Zap on the "Zap Scanner" section. I did this module a while ago but I remember feeling like the zap UI was not intuitive so I honestly never used it again

[proud sparrow]

@west canopy idk what to choose yet cus still not familiar with each of them enough, so i think cus ZAP had the HUD thing idk how i can see the flag using burpsuit, l

@west canopy i did it using bupsuite but thats not fair tbh, took me a while to understand how to solve it and still didn't start with burpsuite yet 🙂

[west canopy]

Hey it's all fair game in my opinion!

[frosty finch]

Hi guys, somebody can help me with the Skill Assessment - Broken Authentication? I can't found the right account. I want to say more details but, I don't want spoil a new one that start this module. Then can someone tell me if I can send you a DM?

[unreal sigil]

what am I doing wrong lol

academy > cracking into htb > getting started > privilege escalation

I've already done all this

already got first flag of module too

[fickle spruce]

Shells & Payloads The live Engagement final question.

Note for Host-3 is that its a 2017 exploit that makes System Admins Blue.

Eternal Blue is not cracking it though.

Anyone want to point me in a direction?

Also ran smbclient and it said SMB was disabled.

[feral gyro]

still stuck

[unreal sigil]

Yes

[feral gyro]

DM

[west canopy]

@fickle spruce i believe i was able to get in using the psexec eternalblue in Metasploit

[lyric mason]

How could I use the exploit from searchsploit ?

[lucid mirage]

searchsploit -m ?

[rustic sage]

^ this followed by the file's name

[topaz crag]

Hi can someone point me in the right direction for Case#4 of the SQLMap essential module? I have tried everything over the past 2 days, I used the -r option but no result. I am very new to all this so any help will be much appreciated.

[leaden quail]

Did somebody finsih the web proxy module? I have a question to the previous question "Once you decode the cookie, you will notice that it is only 31 characters long, which appears to be an md5 hash missing its last character. So, ..." in the Skills Assessment. Im wondering where i should put the cookie in the Header.

I do it this way, but it does not work

[jagged zenith]

Any one get certificate CBBH

[topaz crag]

😦

[distant cradle]

Does anyone know why I get this when I use wpscan? -->Aborted: The remote website is up, but does not seem to be running WordPress.<-- I'm in the final section Skills Assessment - WordPress

🤨

[rustic sage]

Did you make sure that the URL is pointing right to the wordpress installation ?

[distant cradle]

Yes, the strange thing is that they give me only the IP but without any port

[rustic sage]

So it means that it's on 80/8080 port I guess

I haven't done that module so I may be totally wrong

[distant cradle]

I have tried, but it does not detect that it has wordpress. And I have looked at ports with nmap and nothing appears to me apart from 22 and 80

Can i ask the hbt-academy staff?

[rustic sage]

I think you can yeah, they'll be able to help in a better way that I can

[distant cradle]

Where should I write to them?

[rustic sage]

You can open up a ticket on the website

[distant cradle]

And in this discord?

[rustic sage]

The best you can do here is wait for members / staff to notice I guess, I don't really know to be honest

[mortal basin]

Are you connected through the VPN? The exercise gives you a VPN key, which you can use to access the web app.. it's on port 80, so no port is needed to be entered

[distant cradle]

In htb-academy I have never used the vpn, only with the interactive instance it lets you get in

[mortal basin]

Are you using pwnbox? If yes then you don't need a VPN as it connects you automatically

[distant cradle]

Yes i use pwnbox

The problem with the last section is that wpscan doesnt detect that the page has wordpress

[mortal basin]

Oh, so you can access the web app? Yeah thats part of the exercise

[distant cradle]

Yes

I also tried to restart the pwnbox and the target

[distant cradle]

And without wpscan I can't do anything

[mortal basin]

As mentioned above, this is part of the exercise. You're skipping one step

[distant cradle]

Any tip?

[distant cradle]

I don't understand what you mean

[mortal basin]

Check the wp blog

[distant cradle]

#wpscan --url ip -->Scan Aborted: The remote website is up, but does not seem to be running WordPress.

[quaint marsh]

command= "sudo -l" talk to you what you can!

I also have problems using this exploit (50064). Should it be uploaded to http://blog.inlanefreight.local/ or used in msf ? in msf at startup gives an error!

[red obsidian]

There is no flag here. Get back to hacking!

[quaint marsh]

msf6 > use /modules/50064.rb
[*] Using configured payload php/meterpreter/bind_tcp
msf6 exploit(50064) > options

[quaint marsh]

Probably requires login/password options?

Do I need to brute force Nick with a password?

msf6 exploit(50064) > run

[] Got CSRF token: f9edfa075a
[] Logging into the blog...
[+] Successfully logged in with demo
[] Uploading shell...
[-] Exploit aborted due to failure: unexpected-reply: Unexpected json response
[] Exploit completed, but no session was created.

what is Username/pass? Demo?

VHost -blog.inlanefreight.local !

[acoustic owl]

No, you have other credentials

[muted rampart]

Hey guys, I am stuck in the module Information Gathering - Web Edition in the Active Submodule Enumeration. So far I have done the zone transfer but now I don't know how to get the FQDNs and the A records and how many zones are on the server

I would really appreciate some help

[fickle spruce]

@west canopyYeah I accidentally typed LHOSTS instead of LHOST when setting the IP. LOL

[distant cradle]

No

[acoustic owl]

Are you sure that your target is actually a Wordpress site?

[distant cradle]

I have put in ip the ip of the target machine

[acoustic owl]

look at the source code of the website. Is it a Wordpress site? The error message says that your target website does not use Wordpress.

This is exactly what 21y4d tried to explain to you

look at the source code

[rustic sage]

I really like HTB academy, courses are really good, but honestly I have to say that questions are often unclear. It makes me loose much time.

[acoustic owl]

what question do you mean?

[mortal basin]

Please let us know if you find any question to be unclear, and we'll do our best to fix and clarify the question

[rustic sage]

I'm currently doing Broken Authentication / Bruteforcing Cookies / Question 1. I am trying all the "super user" roles I can think of, because the difficult part here is not the cookie handling but the guessing one.
But my remark applies for several questions of several modules, it's not the first time I find a question unclear. I discussed with a friend the other day and she agreed too.

[mortal basin]

We'll check this one. Let us know of all others and we'll look into them as well

[rustic sage]

Ok I'll let you know, thank you.

[solid lark]

Hi!! I'm stucked in the file upload module, someone could give me a hint? I have tried to fuzz all possible extensions and the ones allowed did not execute code

[zealous fiber]

Hello, I am stuck on the broken Authentication Skill Assignment. Can anybody give me tip? I got the decoding algorithm and the other users

[acoustic owl]

What question exactly do you need help with? Feel free to dm me

[acoustic owl]

feel free to dm me

[sharp rose]

posted issues in channel #858470491676737536 hope it's the right one
#858470491676737536 message

[west canopy]

@zealous fiber You will first need to identify the the username for the support user. It is in the format of support.xx (the extension being a possible country code). Once you have identified the correct support account, you will need to filter the rockyou.txt wordlist for passwords matching the requirements for the website

[west canopy]

I think i had to change the payload to TCP_Reverse_Shell (by default it is set to Bind shell i believe)

[slender eagle]

can anyone help please?

[autumn pilot]

try explaining your logic rather than just paste a screenshot of the questions

you will benefit more

[slender eagle]

i dont know how to find that

[west canopy]

@slender eagle also try to include what module/section you are working on 🙂

[slender eagle]

linux fundamentals

im confused

[west canopy]

Try to re read the section carefully. What environmental variable is used to identify the shell? What command can you use to output it to your terminal?

There should be examples provided in the section to help you solve the questions

[slender eagle]

There isn't anything for what they are looking

Also in this question they were asking for kernel version but correct answer was kernel release

so correct answer was kernel release but they asked which kernel version is installed on system

[ornate oxide]

Hello, I just want to confirm something with the web requests module. On the GET section, it is broken right? No way to get the flag? And if so is there a way I can get it just so I have the module done? Thanks guys

[slender eagle]

@west canopy

[west canopy]

@ornate oxide DM me 🙂

[slender eagle]

how to find a shell for user

[sly nebula]

Is it normal spending one week trying to find one valid credential in "PASSWORD ATTACKS" - Credential Hunting in Linux? Or am I missing something?

[slender eagle]

academy isnt worth it. its broken and they put one thing in questions and answer is something different

[slender eagle]

@sly nebula

look at thids

[proud sparrow]

hello guys, idk what to do,,,im in PROXYING TOOLS and trying to setup /etc/proxychains.conf so i can make any command with proxychains also did the same as HTB steps and tried to test it by cURL http://......, and show error :[proxychains] config file found: /etc/proxychains.conf
[proxychains] preloading /usr/lib/x86_64-linux-gnu/libproxychains.so.4
error: invalid item in proxylist section: https 127.0.0.1 8080

how to fix it

?**

PROXYING TOOLS section in USING WEB PROXIES module ******

@west canopy

[unreal sigil]

nothings happening when I run my ncat

[distant stream]

Dm if you still need help.

[unique valve]

Keep in mind that command you issued is starting a netcat listener on port 9443. Typically the purpose of that is to catch a reverse shell connection that gets initiated from the target system.

[west canopy]

@proud sparrow I wasn't able to get it to work either, but you can find the answer to the challenge questions by looking at the options for the exploit in Metasploit

[proud sparrow]

@west canopy im still trying 😐

@west canopy i didnt understand what do you mean "but you can find the answer to the challenge questions by looking at the options for the exploit in Metasploit"

[west canopy]

so it asks what the the last line of the request is

if you look at the options for the http_put exploit

like this

it's three words 🙂

[proud sparrow]

i changed the options but what next, sorry im missing something here?

[west canopy]

there should be an option called FILEDATA , so take a look at that

[proud sparrow]

msf test file?

[west canopy]

try it 🙂

[proud sparrow]

didnt work as answer

[rotund gust]

Would anyone be able to give a nudge on the "Zap Scanner" section for the "Using Web Proxies" module? I cannot seem to get the high-level vulnerability even though I'm using the active scan

[west canopy]

@rotund gust DM me 🙂

[frosty finch]

Hi guys. Somebody can help me with the Skill Assessment - Broken Authentication? I'm really stuck and so frustrated😣

[feral gyro]

DM

[proud sparrow]

@west canopy im in ZAP FUZZ section and dk what exactly the question want..this is the question: -----------------The directory we found above sets the cookie to the md5 hash of the username, as we can see the md5 cookie in the request for the (guest) user. Visit '/skills/' to get a request with a cookie, then try to use ZAP Fuzzer to fuzz the cookie for different md5 hashed usernames to get the flag. Use the "top-usernames-shortlist.txt" wordlist from Seclists.----------------- so i did the first step and got the cookie but what to do next like?

[west canopy]

@proud sparrow so i used Burp intruder because I'm not a fan of zap

[proud sparrow]

yeah but what the question want?

then try to use ZAP Fuzzer to fuzz the cookie for different md5 hashed usernames to get the flag. Use the "top-usernames-shortlist.txt" wordlist from Seclists.

here i didnt understand

[west canopy]

so you need to fuzz the cookie using a wordlist

in burpsuite it looks like this

[proud sparrow]

should i use the cookie as what? directory?

[west canopy]

then set the Wordlist as the payload and encode with MD5

[proud sparrow]

yo in zap i cant make ATTACK on the request i got thats why im stuck

@west canopy do you use burpsuite for FUZZING?

[west canopy]

yep

burp intruder

[proud sparrow]

but its not good for fuzz speed

[west canopy]

yea it's hella slow

[proud sparrow]

i can use ffuf for fuzzing or gobuster and continue with burp

but how you do fuzz for cookie as md5hash ?in burp

i figured out 🙂

[burnt wave]

Anyone have a recommendation for what path to take the modules in? So far I have done Linux Fundamentals -> Windows fundamentals and I am thinking of continuing on to do Networking Fundamentals-> Analyzing Network Traffic -> Web Requests -> Web Applications but I do not know where to go from there really

[west canopy]

personally i started with intro to networking -> linux fundamentals -> windows fundamentals -> Nmap -> Login Bruteforcing -> Hashcat -> FFuF

[burnt wave]

hmm. Maybe im overthinking this and should just go with the flow

[west canopy]

Yea you can't really go wrong

[lost kayak]

in

[tiny ledge]

Can someone help with the: INFORMATION GATHERING - WEB EDITION - Active Subdomain enumeration part

None of the commands shown in the module work with the inlanefreight.htb

nslookup -type=NS inlanefreight.htb 10.129.42.195
Server: 10.129.42.195
Address: 10.129.42.195#53

inlanefreight.htb nameserver = ns.inlanefreight.htb.

Got this just like shown in the module

nslookup -type=txt -query=AXFR inlanefreight.htb ns.inlanefreight.htb
nslookup: couldn't get address for 'ns.inlanefreight.htb': not found

but the next part doesn't give me anything

[distant cradle]

I can't find anything, the only thing that i can see is: http:// w3layouts.com/

[eternal relic]

Have you been able to solve it?

[unkempt marten]

Can I get some help with buffer overflow linux?

I'm unsure what a question is asking for

[quaint marsh]

Username == htb-student
Password == HTB_@cademy_stdnt! ????

[quaint marsh]

[-] Exploit aborted due to failure: unexpected-reply: Unexpected json response

[quaint marsh]

Nick? i have't pass

[acoustic owl]

There is a menu on the page, right?
Look around the whole website. Maybe you will discover something?

No, there are other credentials.
I am no longer sure where I found them. I didn't write that down at the time.

[tacit topaz]

Hi, anyone can help me with the predictable reset token of the broken authentication module ?

[lethal atlas]

I can sure try

[distant cradle]

I'll be very stupid but I don't see anything 😂

[tiny ledge]

Can anyone help with this: What is the FQDN of the IP address 10.10.34.136? None of the commands like whois/nslookup/dig find anything about this

[acoustic owl]

You're in the skills assessment in the wordpress module, right?

Take a close look at the target website. Navigate around it. Look at the source code. It doesn't seem to be a Wordpress site. But you are in the Wordpress module and expect a Wordpress page.
Are there links to other pages?
Are there any hints in the source code?

[distant cradle]

No

[distant cradle]

I have tried it

[acoustic owl]

Have you ever tried a zone transfer?

[distant cradle]

I've done-->Ctrl+U then Ctrl+F (http) and then with each of the pages that have come out I have used wpscan

[acoustic owl]

Then you may have attacked pages that you did not want to attack. 👀

Take a look at the website at your leisure.
Surf around on it. Look around in the source code.

There is a menu at the top of the page. Could any item in the menu indicate a Wordpress installation?

Do not attack! Only look

[tiny ledge]

Can you elaborate more on this, I've read about it but don't quite understand it

[acoustic owl]

https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2003/cc781340(v=ws.10)?redirectedfrom=MSDN

[rustic sage]

hi! Could someone kindly assist me on "Attacking Web Applications with Ffuf "
The skills assesment fuzzing extensions? Please and thank you

[lethal atlas]

what part do you need help with?

[rustic sage]

the second question in the skills assesment, fuzzing extensions

[rustic sage]

i think my ffuf is misbehaving... but I am not sure what to make of it

[lethal atlas]

did you get question 1?

[rustic sage]

yes, but its hard, I really think my ffuf is confused, or I dont know how to sort through its results

[lethal atlas]

ok so using the subdomains you found in question 1 do a fuzz for web extentions.

/SecLists/Discovery/Web-Content/web-extensions.txt:FUZZ

it will require 4 fuzz attempts, 1 for each sub

[rustic sage]

[Status: 200, Size: 985, Words: 423, Lines: 55, Duration: 186ms]
| URL | http://academy.htb:32386/#.js
* FUZZE: .js
* FUZZ: #

[Status: 200, Size: 985, Words: 423, Lines: 55, Duration: 187ms]
| URL | http://academy.htb:32386/#.jhtml
* FUZZ: #
* FUZZE: .jhtml

[Status: 200, Size: 985, Words: 423, Lines: 55, Duration: 186ms]
| URL | http://academy.htb:32386/#.jsp
* FUZZE: .jsp
* FUZZ: #

it seems like everything is a success, but they are not

so I started looking for odd ones out with -ms 0, but thats not very practical

[lethal atlas]

you likely need to filter out 985

dm me

[buoyant veldt]

Hi 👋🏻

are there any new news with these modules?

I mean, I ask this because in 9 days my access expires

[livid pier]

[buoyant veldt]

so knowing that I'll know if I have to pay another month

[buoyant veldt]

(sorry, I forgot to send the message 😅)

[quaint marsh]

I wonder where I was supposed to find this data, except in the tooltip?

[quaint marsh]

If this data needed to be taken from other servers, then it was necessary to warn about it.

[lethal atlas]

what are you talking about? they give you that info so you can login to do the module

[livid pier]

Anyone complete the intro to assembly language mod?

[devout cliff]

hey everyone, doing the skill assessment for sqlmap today and im really close to finishing it but i am stuck on fully exploiting the vulnerability on the target. anyone around that has done it before that i can talk details with, specifically what syntax i might be missing?

[lethal atlas]

hit me up bro. I got you

[flint helm]

Hey I've been lost for a while with the whole "Active Subdomain Enumeration" section of Information Gathering, I've successfully completed a zone transfer and now I'm looking for the TXT record. Here are some images if it helps, help would be greatly appreciated.

[west canopy]

@flint helm try running dig txt against all of the subdomains you discovered, one of them should reveal the answer

[flint helm]

ok I'll try it out ty

[flint helm]

ayy thanks man

[lethal atlas]

dm me

[sudden cloak]

Can someone help me with the footprinting lab - hard>

[wooden yarrow]

hey so i just started and Interactive Section with Terminal instance is not loading, i have the student membership and good internet throught ethernet connection

nvmd lol

loaded after 15 minutes

[serene rain]

Hey ! Just for my curiosity : I saw that HTB added time estimates for modules. But, how many hours are there in one day ? 7, maybe 8 ?

(Yeah, very important question 😄 )

[unreal sigil]

I'm in serious need of help on getting start > nibbles initial foothold

been trying for two days

nothing happens when I try to start my netcat

[devout cliff]

i feel a bit cheated on a question in Intro to network traffic analysis

True or False: when utilizing HTTPS, all data sent across the session will appear as TLS Application data?

i feel this question is worded a bit too ambiguously

[distant cradle]

Nothing...😩

[acoustic owl]

Did you find the website menu?

[distant cradle]

No

[steel flume]

anyone here able to give me some assistance with nmap?

[livid pier]

Whats up?

[steel flume]

i am doing this module asked to figure out the dns server version

but i can't understand the commands. if able to help dm me so we don't spoil anything

[livid pier]

ya sure

[proud sparrow]

@west canopy@livid pier i have problem in ZAP scanner section in USING WEB PROXIES module , so i can't use burp instead cus scanning with burp needs the pro version of it so i must use ZAP scanner to find the FLAG.TXT and when im trting to use the HUD of ZAP nothing of the buttons works i have tried to make it by the ZAP tool not from the HUD but it didnt shows the critical or high alerts as it says in the questions? any help?

[west canopy]

@proud sparrow I had to use ZAP's built in browser in order to get the HUD to show up

[proud sparrow]

thats how i use it either but still i cant use the buttons :/

[livid pier]

I forgot that section, what are you scanning?

[proud sparrow]

active scan for ZAP tool they want me to do it by ZAP

scanning for vulnerabilities

this is the question----------Run ZAP Scanner on the target above to identify directories and potential vulnerabilities. Once you find the high-level vulnerability, try to use it to read the flag at '/flag.txt'

[west canopy]

I was able to do it without the HUD though

[livid pier]

silly question, have you tried refreshing the browser after you fire up zap?

[proud sparrow]

i know its silly question its not letting me do it

im trying without but its there is no high level shows up for me so i can head to

[livid pier]

no, my question is silly. But the browser wont let you refresh?

[proud sparrow]

ah sorry , its refreshing normally

like when i press on the Spider Start button its telling me i need to put the site into the scope and by pressing start its automatically moves to the scope and should start but when i press start its nothing happening

any one pleas? i cant skip the question otherwise im loosing cubes

[livid pier]

maybe try restarting your comp, that is a good first step

[proud sparrow]

@livid pier same still not working....

[whole cosmos]

Trying to work through windows fundamentals module, seems totally f'd, can't RDP to any of the machines without it killing itself

[livid pier]

@proud sparrow have you tried to enumerate the webpage manually?

[proud sparrow]

yes it works

[livid pier]

and you found the flag?

[proud sparrow]

no it shgould be an high-level alert so the flag.txt inside it

and there is no high level alert

[livid pier]

ok what i am saying is get creative and do it manually

@proud sparrow do those screenshots make sense to you?

[stiff tiger]

I had same problem with ZAP HUD not working. I tried from my own kali via VPN and had the same problem until I updated ZAP - you could maybe try from your own machine on VPN or try updating zap in the pwnbox. Also you can do it without HUD in ZAP as the main interface shows high alerts.

[proud sparrow]

yes let me go through it..

[shadow inlet]

hi guys how to change a langugae?

[livid pier]

what do you mean?

[shadow inlet]

in website

hackthebox

change language

[livid pier]

Not sure

[proud sparrow]

@stiff tiger how can u make it through VPN?

[livid pier]

@proud sparrow I dont think the alert was going to give you the flag, just show you what the vuln was

[proud sparrow]

yeah im trying to make and understand what happend

thank yuo though

[livid pier]

@proud sparrow GL the answer is there

The mods teach you some other important stuff that isnt always in the mod

for instance, some times things dont work. But there is typically multiple paths to where you need to go

if one path is blocked go another route

[stiff tiger]

I have a .opvn cert from a prior lab - I used that.

[hardy sandal]

i need to hack someone like really badly. They are a terrible person. Because of them i have lost contact with many new friends because i cant dm those new freinds because now i dont share a server with them. l noow cant find people to play with in a game i love. they are a zoophile peice of trash. please i need anybody who can hack them

[livid pier]

WIll this be in exchange for V-Bucks?

And what do you mean when you say hack the person? Like what specifically?

[broken bronze]

anybody provide a hand on the assembly language module?

[livid pier]

Im working on it, where you at?

[broken bronze]

@livid pier jne . can i dm?

[livid pier]

What section is that?

[dusk sandal]

I'm currently stuck on the Host & Port Scanning Module. Does anyone by chance have advice on how to get htb-student@10.129.2.49's password?

[lethal atlas]

I understand you might be upset, but what you are proposing is illegal. What we learn here is to be used only for good, no matter how much someone may deserveit.

[light portal]

Like with an axe?

[livid pier]

He is filled with vengeance. I see a post like this once a month, I wonder how they hear about this channel

[idle cliff]

Hey guys, looking for some help on the module for Web Requests PUT and DELETE.

I'm instructed to input this command:

However, this is the response I get:

jq: command not found

Any idea what's going on here?

[devout cliff]

bash not able to parse what jq is that you are piping to

im not familiar with jq, is it suppose to be a command you know?

[idle cliff]

I'm just following the instructions in the HTB module, this is the first I've heard of it

[devout cliff]

so apparently its a command-line JSON processor

do you have it installed?

see what happens if you type 'which jq'

[idle cliff]

Gives no response at all

[devout cliff]

so

you dont have it installed

so you need to install it

[idle cliff]

Ah weird. Do these modules often have you execute programs that aren't already installed?

[devout cliff]

sometimes yeah, ive had it happen

or something out of date

you should have the credentials for the box you are on

[idle cliff]

Ok so I'm guessing I'd need to sudo install it, but I don't see my password anywhere in this instance

[devout cliff]

its on the desktop

or should be

[idle cliff]

Has a target ID, but nothing else

[devout cliff]

on your pwnbox it doesnt have a credential file?

[idle cliff]

There some easy way to find it?

Credential file?

Oh snap, I've been in the command line the whole time didn't realize there was a folder right there

[devout cliff]

yeah

[idle cliff]

beautiful

[devout cliff]

there should be a credential folder in there with sudo pw

[west canopy]

can run: sudo apt install jq

[devout cliff]

so i just checked myself and didnt ahve it installed in my version of parrot either

^

[idle cliff]

found where somebody had a similar issue on stack overflow

Looks like a github link there was posted I'll try that

[devout cliff]

double check the link and make sure it looks correct

should be for a command-line JSON processor from what i read

gotta change my VM credential now lol

at least thats easy

but @idle cliff i will be sleeping so hopefully if you still got problems someone else can help you ❤️

gl

[idle cliff]

No worries, I appreciate it. Just wanted to make sure it wasn't just me messing something up

[steel flume]

am i looking at the wrong thing for service version in the nmap module? i type in the service version for the ssh and it's apparantly the wrong solution?

[idle cliff]

I believe to find the service version for SSH you're working with is:
ssh -v localhost

[steel flume]

yeah that just connects me to it. doesn't seem to give the right answer

[west canopy]

What section? I don't recall there being a question asking for an SSH version

[steel flume]

just me being stupid i figured that i am hitting the firewall so i am reassesing how to get through it

[west canopy]

ah gotcha 🙂

[steel flume]

the --source-port doesn't work and i now see it may be slightly out of date with how nmap works now

[west canopy]

--source-port 53 should work for the Hard Lab

[steel flume]

yeah i will try -g 53

will hit this again tomorrow

[idle cliff]

my bad, I misunderstood your question

[tiny ledge]

I'm having really hard time with the zone transfer, do I need to copy the steps with the 'nslookup -type=any -query=AXFR zonetransfer.me nsztm1.digi.ninja' OR use my own domain -> inlanefreight.htb? | I'm getting nothing but errors whichever I try

Connection to 81.4.108.41#53(81.4.108.41) for zonetransfer.me failed: timed out.

[slow bluff]

Hi, Any one can help with osint Module > Section Location > i am having trouble submitting city's coordinates i cant figure out the right answer format i think

[wintry gorge]

need some help on the file uploads module 😛

[tacit topaz]

Hi I need help with the first question of bruteforcing cookies in broken authentication... I tamper the session cookie but I still get no flag...

[jagged zenith]

Any section

[wintry gorge]

nvm solved it! Thx

[tight mesa]

hello y'all, who can help me with fuff mocule?

I'm having an issue with the extensions question..!!!

[west canopy]

@tiny ledge Is that for information gathering web edition? Usually for a zone transfer the format would be something like: dig axfr inlanefreight.htb @ipaddress

@tacit topaz You should be able to get the flag once you modify the cookie to be|| "role:super"||

[broken warren]

Sqlmap fundamentals case#3. I'm confused what the question is asking and what the hint is referring to. I've tried intercepting with burp and running sqlmap -r req.txt --crawl=2 but the only value given in burp is cookie: ID=1. Am I even close?

[west canopy]

@broken warren try setting the injection point to be --cookie='id=*'

[tacit topaz]

OK, thanks I tried multiple role but not this one 😄

[west canopy]

Yep I was not a fan of that question . Basically just makes you guess what the super role is.

[tender dock]

Module: Footprinting lab#1: I just cannot seem to grok how to enumerate ftp in such a way as to gain access on the ftp server running on an alternative port. Any hints?

[leaden sail]

Hey, speaking of Sqlmap fundamentals... I'am stuck at the Skills assessment I know where to attack but every time I run sqlmap after a few checks I am "unable to connect to the target URL ('No route to host')" is something wrong with my Internet? Or is this just a obstacle I have to overcome😅

[west canopy]

@tender dock you can connect to the vsftpd service on port 2121. The command is just: ftp ipaddress 2121 . From there you will find a file that will help you SSH into the target

[broken warren]

Much appreciated 👍

[west canopy]

@leaden sail Sounds like you might need to respawn the target. I know on my end, docker targets i sometimes have to spawn multiple times before i can connect

[leaden sail]

hm, ok I'am stuck on this problem for a few hours now and restarted it multiple times...
I'll try it again

[tender dock]

@west canopy I'm afraid it's not working. and it's not vsftpd, but proftpd. not the username that is hinted to, and not anonymous

[tight mesa]

hello guys, I'm stuck with extension question under fuff module

[west canopy]

@tender dock check for hidden files/folders 🙂

[tight mesa]

who can give me a hint, because I could found 3 different .php extension but when I write my answer is not working..!!!

[tender dock]

that's already beyond the step I'm at. brute forcing didn't give me a password. Guess I'll continue trying that. Once I am in, I know what to do 😉

[tender dock]

Thanks a lot for helping out

[west canopy]

Check the hint, you want to connect to ftp as the ceil user

[tender dock]

I know, but you appear to have the pwd, which I don't

[west canopy]

it's in the hint 🙂

[tender dock]

ooooh! haha facepalm

my lord... it's the simple stuff....

[west canopy]

@tight mesa the solution is three different variants of the php extension , just need to type them in the right order and it should accept your answer 🙂

[tight mesa]

yep I now that, but I did with not success, let me try again

[leaden sail]

Restarted it twice again but the problem persists :/

[jagged summit]

Module: Windows Fundamentals.

Skills Assessment.Can anyone help me with the first question.

[livid pier]

[west canopy]

@jagged summit Edit: Removing Spoilers. DM me 🙂

[tacit topaz]

Hi can I dm someone about the skill assessment of the broken authentication module ? I think I'm doing the "right" thing but I get nothing...

[west canopy]

@tacit topaz i got you dawg

[steep sable]

Hi, could someone help me with OS Exploitation module. The last flag. I managed to get the OS shell, but all I can find is the flag from the previous question

[rustic sage]

Hi, I'm on broken authentication / skill assessment too, I got an account, but I've not idea what the next step of the exercise is. May I ask to someone?

[west canopy]

@rustic sage you will want to find out the username for the support user and then try to log in as him

[rustic sage]

@tribal cargo I'm logged as a support already. May I pm you to explain what I did? I'm not sure what I can say here and what is actually spoil.

[west canopy]

Yes DM me 🙂

[lyric mason]

I am trying the question (After obtaining a foothold on the target, escalate privileges to root and submit the contents of the root.txt flag.) in GETTING STARTED and i dont know how to get root After sudo -l and run LinEnum.sh I got this : www-data@gettingstarted:/var/www/html/plugins$ sudo -l
sudo -l
Matching Defaults entries for www-data on gettingstarted:
env_reset, mail_badpass,
secure_path=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin

User www-data may run the following commands on gettingstarted:
(ALL : ALL) NOPASSWD: /usr/bin/php How should I use the path /usr/bin/php to gain to root?

[west canopy]

@lyric mason so php is actually a "GTFOBin" which means it's a linux binary that can be used to break out of restrictive environments. Try some of the techniques shown here: https://gtfobins.github.io/gtfobins/php/

[lyric mason]

thx a lot

[west canopy]

If you get stuck DM me and I can go into more detail 🙂

[steel flume]

how do i get nmap to list the filtered ports?

[lethal atlas]

-p- -Pn scans all ports as up

[west canopy]

Yea I don't think there's an option to specifically show filtered ports. Typically it's not something you would look for . A port will show up as filtered if nmap isn't exactly sure if it's open or not.

[steel flume]

well i am trying to get through the firewall of the filtered ports. but since i got no clue which ports i should target i am a bit stumped

[sweet heron]

Hey all! I'm wondering if the password attacks module is suppose to be completed only with the resources files or do we need other lists like rockyou or 500worst? It is not possible to complete most of the exercises since it takes ages using the default lists (and I can't seem to find anything...). Any hint (for all exercises in the remote password attacks section!)? Thanks in advance. I must add, I searched this chat history and even with some hints on the usernames/password, I can't connect with evil-winrm (first exercice in network services).

[lethal atlas]

what module are you working on?

[junior hazel]

Hi
Someone finished Footprinting Medium lab ? I'm stuck

[livid pier]

Where you stuck?

[steel flume]

nmap emuration

i got 129 ports that are filtered and i need to figure which one so i can narrow down my attack

[sweet heron]

yeah, but which exercise?

[steel flume]

its the firewall hard one

i know i am looking for a particulare port that is among the filtered ones. in order to find it's service version. but first i need to figure out what ports are filtered

[lethal atlas]

no you dont, just need the proper nmap scan

[devout cliff]

stuck on this question in Intro to Network Traffic Analysis

What are the client and server port numbers used in first full TCP three-way handshake? (low number first then high number)

[lethal atlas]

dm me and I will help you

[devout cliff]

i think i know how to read it but it is not working

[west canopy]

@steel flume try doing nmap -p- with --source-port 53

@devout cliff

[devout cliff]

yeah i found it, i thought it was asking for the https not http

woops

[mystic perch]

Hey, Is there anyone who can help with the LFI module?

[solid lark]

yep, dm me

[sweet heron]

Nobody for password attacks?

[heady nova]

DM if you need, i'm on the last question

[west canopy]

I'm scared to try that module brother lol

[distant stream]

What’s the question? Dm if you need help

[sweet heron]

some exercices are bs... but they're not giving cubes at least. I was able to complete the ones that give +1 cubes at least.

[devout cliff]

is that the module for hydra or something else?

[west canopy]

@devout cliff It's a new module. The Login Bruteforcing with Hydra is pretty tame but this new one looks rough.

[sweet heron]

no, it's the new medium one

[devout cliff]

oh boy

here i go brute-forcing again

[livid pier]

password attacks be booty

[west canopy]

@livid pier how goes the Assembly?

[livid pier]

That is a great mod, taking a break and getting beat up on talkative at the moment

[lethal atlas]

I stepped back to do the updated LFI module. Hated that it didnt show complete still lol

[west canopy]

I finally got VIP on the main HTB website so the other night I was working through the starting point machines that i couldn't access before

[lethal atlas]

Nice, I havent upgraded there yet

[valid peak]

im new

[rustic sage]

Welcome.

[valid peak]

how do i get roles

how do i become a "hacker"

[rustic sage]

Look into #welcome and verify.

Your role on Discord depends on your level on the HTB site @valid peak

[valid peak]

ok

[solid lark]

someone have solved the wordpress module? please dm me

ahh okay

[rustic sage]

Don't do that here.

[valid peak]

ok

[rustic sage]

@solid lark same

[solid lark]

sorry

[rustic sage]

@valid peak This is your Discord rank, depending how active you are here... nothing to do with "roles"

[valid peak]

im aware, im in a few other servers with this ranking system

[steel flume]

netcat won't work with the nmap module even my own box won't let it work as the module ays it should

[rustic sage]

@steel flume Which section of the NMAP module?

[steel flume]

the hard part at the end. i found the port iin question doing a stealth scan. so i now have the port but i can't do the netcat part someone else did.. so i wonder why the pwnbox or my own vm box can't

if it is a tool issue on my end i need to know how to fix and verify

[lethal atlas]

that still didnt work? Did you update your vm?

[steel flume]

yes

i am confused

[lethal atlas]

Yeah I am super confused. I am using Kali, updated at least 3 times a week.

[steel flume]

parrot

should i try install netcat a different way?

[lethal atlas]

is your 7.92?

ok according to the man page, you should be able to use -p instead of --source-port

nc -nv -p 53

[steel flume]

will try that

now i keep get a mesage saying can't resolve hostname

[valid peak]

cool website

[west canopy]

@steel flume For the hard lab I had to use source port of 53 when connecting with netcat as well

@solid lark I might be able to help 🙂 What section/question?

[steel flume]

hmm i managed to mess up my nmap tool do i need to do a reinstall or is there a less destructive way to fix it?

[maiden slate]

How did you mess it up?

[flint helm]

Hey I'm stuck on the SQLMAP ESSENTIALS'S Skills Assessment. I've found and attacked a*****.php and I've found out I had to use a certain tamper script but it seems I need more bypasses. I've tried a lot of things and I just can't figure out what I'm missing. I would greatly appreciate a nudge.

[west canopy]

@flint helm you will need to do a Timing based attack

[flint helm]

I've also tried that with my tamper, you mean --technique=T right?

[west canopy]

Yes, feel free to DM me and i can get more specific

[flint helm]

Ok I'll reset my machine, try again and if I'm still stuck I will ty 👍

[heady nova]

Hello, can i have a nudge on Skills Assessment - File Inclusion ? Thanks 🙂

[lethal atlas]

sure

[lethal atlas]

his problem is the the netcat command doesnt work for him. I even tested on my machine and the command works perfectly.

[devout cliff]

i had the same problem just 1-2 days ago. the solution was rather funny

[west canopy]

I think we got it resolved

[flint helm]

I think it's working but it's kinda slow

I guess it's that i forgot to use --dump

[sweet heron]

I have a problem in password attacks, network services section. Using hydra to bruteforce smb, it instantly give back ERROR invalid reply from target. My line: hydra -L names.list -P rockyou-30.txt smb://10.129.124.150 -I
I can ping the target just fine. Also can't use xfreerdp, getting some errors. SSH and winrm work just fine

ok I got RDP (used the wrong creds), but still can't use hydra for smb. Any alternative?

[broken bronze]

Can anyone help with assembly module (proc) section

[distant stream]

Patator mmaybe?

[sweet heron]

I'm trying ncrack RN. There are medusa and msf smb_login too. I'll try them later... But still, I don't get why it's not working.

[flint helm]

have you tried: "hydra -L names.list -P rockyou-30.txt 10.129.124.150 smb"?

[sweet heron]

yes, same error

[pulsar gorge]

module 23 (File inclusion ) have a image error 🙂

[distant stream]

I‘m not 100% anymore but try the msf smb_login. It didn’t run because smb accepts any password.

[inland rampart]

Waw

!work

[slow bluff]

what is this rank about :p

[inland rampart]

Active

I don't know

[broken bronze]

anybody doing the assembly module?

[livid pier]

😂

sorry

[west canopy]

Is this a ranking system just for Academy?

[livid pier]

No i dont think so

but i have no idea how it works

[livid pier]

where you stuck?

procedures?

[inland rampart]

Now I konw

[tight ledge]

Can anyone help me with the Getting Started module. It wont accept the user flag, but the retired machine itself will. IDK how that happens

[west canopy]

The Nibbles box?

[tight ledge]

yes

[inland rampart]

I help you

[broken bronze]

anyone a hand on assembly module (procedues) 🙂

[jagged zenith]

Hello

[crystal isle]

Stuck on last question for LDAP skill assessment: "What non-default privilege does the htb-student user have?". Anyone available for a nudge?

[late beacon]

whoami /priv ?

[west canopy]

Also need to run it from an elevated powershell 🙂

[ancient badger]

Hey, I've been trying to do the SQLMap Essentials skills assessment for about 2 days now and I can't seem to be able to dump the db, i found the table and its' contents but i cannot seem to be able to get the flag. i'd love a hint 😄

[steady forge]

Iam stuck on htb academy web requests put and delete module pls help to solve

[rustic sage]

Maybe DM me

[brazen saffron]

Someone can help about the exercice in POST requests please?

[wind pendant]

Help...

[rustic sage]

What have you tried that far?

[brazen saffron]

Can I DM you?

[rustic sage]

Yes

[wind pendant]

Anyone? Plz?

[steep sable]

someone else had problems with Login Brute force module where an error in ssh appears? [Error] could not connect to ssh://<ip>:22 - Timeout connection ?. When running hydra

[wind pendant]

You have to use OpenVPN tunnel

download the academy.ovpn Edit: and run sudo openvpn academy.ovpn on a terminal, in the background.

[steep sable]

ok, I'll try that

[wind pendant]

Did it worked? If you do it on Pwnbox, you don't have to download it. I just did it on my machine, because I daily drive my ParrotOS anyways, so... eh.

[wind pendant]

Looks like the server or something seems down, and so Kvesta and I can't complete the task. RIP.

[tacit topaz]

Hi, Any problem with the academy infrastructure ? I can't access any spawned target...

[fierce atlas]

No problem for me with the vpn

[tacit topaz]

OK, I'm not using the vpn, maybe i should... My pwnbox can't access any target.. pretty weird...

[fierce atlas]

sometimes i need to respawn 3-4x before accessing the machine..

Especially with the container

[tacit topaz]

I respawned like ten times, waiting and testing multiple time between each respawn but nothing...

[wind pendant]

You'll probably need to wait for them to fix the problem, or upgrade the server :/

[tacit topaz]

Yep... I'll read without doing the practice for the moment...

[ancient badger]

Still struggling with this, i'd love if someone could give me a nudge on this

[feral gyro]

DM

[naive aspen]

Reading over the comments, looks like I'm not the only one have issues spawning machines in the academy.

[tacit topaz]

I try again and I can't access the target of the IDOR section of the Web attacks module...
But I can spawn target of xxe section of the same module... it's weird...

[west canopy]

Good morning friends 🙂

[lethal atlas]

Good morning

[naive aspen]

*** Just started working again ***
Snap! I can spawn a server and get an IP\port but I can't connect to it, although the idor section are public IPs but the xxe are internal via the VPN.

[lethal atlas]

DM me

[tacit topaz]

Yep your right, and yep i have the same problem i can spawn but can't connect

[naive aspen]

Looks to be working again. Someone must have switched it off and on again! 🤣

[tacit topaz]

Nice ! I will finish the xxe section and I go back to the IDOR after

[torpid ermine]

can you help me to solve one section in file uploads module

can i dm you ? 🙂

[west canopy]

@torpid ermine I got you dawg!

[torpid ermine]

can i dm you ?

[west canopy]

sure

[jagged zenith]

Hello guys

How get certificate cbbh

[west canopy]

I imagine they would email it to you or something once you complete the exam

[strange arrow]

how do I start with this. Where do I go to start learning with the academy

[west canopy]

@strange arrow https://academy.hackthebox.com/ , sign up , use Cubes to purchase modules 🙂

[strange arrow]

@west canopy thank you for the quick responce

[west canopy]

NP, you will definitely want to start with the Fundamental modules like Intro to Academy, Learning Process, Linux Fundamentals, Windows Fundamentals

[strange arrow]

On it.. thnxx

[steep sable]

someone that has done Login Brute Forcing module that could help me with why my command does not work? im doing the Service Authentication Brute Forcing lab

[west canopy]

@steep sable I can take a look

[tight mesa]

Was there an update on the Academy interface, or did I become magically smarter overnight? If it's the former, bravo. Something clicked and made it much easier to follow. Also, thanks for the "Operating Fundamentals System" path, never saw it there before but I was somehow automatically enrolled!

The bipolar in me thinks someone heard my ultra-beginner cries

[lethal atlas]

they have updated and added some things but the more you do on here the easier it is to understand.

[maiden slate]

Anybody online that might be able to help me with a Bash code question. I'm doing the 'Login Brute Forcing' module and ran into a snag.

[west canopy]

I'm a noob with Bash but if you're stuck on the module I can probably help

[maiden slate]

lol, ty bro, so I'm attempting to 'remove no special characters' from the custom wordlist for the SSH hack, and I keep getting 'sed: -e expression #1, char 20: unterminated address regex' error.

wait 1 I think I might have found my problem.

I figured it out. I had a curly brace instead of a bracket. Thanks anyways bud.

[west canopy]

Ah nice work. Sed trips me out lol

also my smooth brain ape mind isn't capable of understanding regex

somehow i've made it this far though

[maiden slate]

lol

Well, let's not go so fast on the nice work, I figured that out and immediately ran into another problem, this time with cloning username-anarchy.

It won't let me follow the example in the module.

Any ideas.....anyone?

[west canopy]

need to go into the username-anarchy directory

when you git clone it , it makes a directory

inside is the actual script

[maiden slate]

lol, so who has the ape brain here? bcuz I think I win that.

[west canopy]

i am a fellow chimpanzee eating the bugs off your back

[maiden slate]

😛👍

[mystic perch]

hey, What is the root password for virtual computers in academy ?

[maiden slate]

try toor

root

admin

<blank>

[west canopy]

@mystic perch do you mean for the Pwnbox? Check the desktop for a my_credentials.txt file

[maiden slate]

My hydra attack on SSH keeps timing out, any suggestions?

[west canopy]

If you have the right command and wordlist, it should crack the password pretty fast

[broken bronze]

Any help on assembly module binary exploitation

[dapper flare]

Hey i'm having some trouble with the Getting Started skill assessment, i got access to the target website's admin panel and found a way to upload files, the problem is that if i try clicking the "upload a file or image" button, nothing happens

am i supposed to do something else or is htb acting up

[west canopy]

@dapper flare This is the Knowledge Test correct? You should be able to find an exploit in Metasploit to get the initial foothold 🙂

[rustic sage]

Does some of you have issues for connecting to the targets machines in htb academy modules. I succesfully connect to the vpn and launch the target machine but im unable to ping the target machine even if I try to ping from the pwnbox instance 🙂

[west canopy]

@rustic sage For docker targets it usually takes me a few respawns before they actually fire up. Also, docker targets typically are not pingable.

[warm lava]

Can anyone point me in the right direction for "Active Subdomain Enumeration" on Information Gathering - Web Edition? I have the same exact issue as this: #modules message I have spent a total of about 12 hours trying to figure out how to get past this. I cannot seem to figure out what it is I need from dig/nslookup to get the answer I need. Any clue would be appreciated.

[west canopy]

@warm lava DM me 🙂

[devout cliff]

having an issue in the Intro to Network Traffic Analysis module. im at the part where you use nomachine to set up the target to sniff on and have that up and sitting on a login page. module says i should be able to see an interface on my VM in wireshark that is listed as ENS224 that i will be using. that interface is not listed. do i need to login to the machine after i connect via nomachine to this weird login page?

[west canopy]

@devout cliff I'm not sure if the NoMachine environment even works anymore. I was able to complete the module just by using the provided pcap files in the Resources Section.

[devout cliff]

which resource, the RDP-Analysis or guided analysis?

actually both or those resources dont look like they are for this part of the module. they look like they will be for the last 2 parts, guided lab: traffic analysis workflow and Decrypting RDP connections

the resource for wireshark i don't think is correct either because i used it for the previous section

unless they are using that resource for both sections? ill double check

actually it might be

yup it is

thats weird that this module is not updated with that information

considering how well used wireshark is

[west canopy]

Yea there's another question where it's like "which employee is suspected of performing malicious actions in the live environment" and I solved it by just SSHing into the target and looking for which users existed in /home/

[devout cliff]

yeah thats the next question lol

[west canopy]

I'm like 95% sure you can't solve it with the pcaps

[devout cliff]

hint says you can by looking at all protocols?

[west canopy]

I mean I'm decently wireshark-savvy but I couldn't find the solution in the pcaps.

[severe birch]

In the File inclusion module, File inclusion prevention, the question: "Edit the php.ini file to block system(), then try to execute PHP Code that uses system. Read the /var/log/apache2/error.log file and fill in the blank: system() has been disabled for ________ reasons."

Is blocking system() the same as disabling it?

[west canopy]

@severe birch I believe so, i think it's basically stopping the server from running system commands via PHP.

[severe birch]

Hmm ok, I'd imagine my problem is elsewhere then.

[devout cliff]

apparently in the pcap they login somewhere, im going packet by packet now and checking

[devout cliff]

like i have the desktop host, still looking for that username lol

[dusk sandal]

Hey, I'm currently working on Firewall & IDS invasion, hard. Does anyone by chance have any pointers?

[formal wigeon]

I found a way to hack any website

but its only on chrome browser wanna know how?

[west canopy]

@dusk sandal try using the source port for a common service to evade the IDS, and be sure to scan for ALL ports

[crystal isle]

whoami /priv doesn't work in this case. Tried both privs listed by this command but both are the wrong answer

[devout cliff]

ok this is ridiculously hard, i still can't find it. been through every packet it feels like, no username anywhere from what i can see

[west canopy]

I came to the same conclusion

[devout cliff]

im doing string searches

hex searches

everything

[west canopy]

@crystal isle use an elevated powershell

right click run as administrator 🙂

[devout cliff]

like i get that the user had to log in at some point but i dont see that request anywhere

[crystal isle]

Unfortunately creds only provide standard domain-joined user, unless I privesc there's no way to get admin powershell but I don't think that's what's being asked

[west canopy]

You can right click and run as administrator with the standard user

[crystal isle]

Right-clicked run as admin > entered creds

[west canopy]

Gimme a minute I'll try it on my end

[devout cliff]

there is no way you find that answer normally

thats ridiculous

i ssh'd like you did

[west canopy]

@devout cliff yea that's the conclusion i came to

[devout cliff]

and then searched wireshark

there is no way you find that

[west canopy]

@crystal isle Just tried it on my end and it works fine for me

[crystal isle]

wth

you RDP with htb-student account? This is the last module skills assessment

[west canopy]

Yes

I can show you if you want

[crystal isle]

Yes please, I must be missing something obvious

[sweet heron]

Any hint for password attacks module, password reuse/default password section? (mysql creds)?

[severe birch]

Could anyone give me a nudge on the File inclusion skills assessment? There was a lot of information and I think I am a little lost.

[mellow whale]

Hey, still having issues with The Traffic Analysis module?

[sweet heron]

I'm having difficulty with this question of the Traffic Analysis module: "If i wished to filter out ICMP traffic from out capture, what filter could we use? ( word only, not symbol please.)"

[mellow whale]

shoot me a message

[distant stream]

Dm if you still need help

[dusk sandal]

Awesome, I'll give that a try. Thank you for the advice!!

[tiny ledge]

What is the registrar IANA ID number for the githubapp.com domain? | Am I supposed to do something else than whois to get this, because I cannot get that to work, pinging the target works though

[leaden quail]

whois should work, if not you should may try another vm

Im Struggeling "What's the contents of table flag5? (Case #5)" from SQLMAP Essentials

ich have the flag from table flag5 but in says "incorrect Answer"

any hints?

[tiny ledge]

Yeah, whois not working on any VM, but managed to dig out the answer from virustotal

[dapper flare]

ooh alright thanks

[rustic sage]

Thank you so much 🙂

[urban flume]

use auxiliary/scanner/smb/smb_ms17_010

[fickle spruce]

@urban flume thanks,

I was exhausted the night;. Posted that question and had misstyped an item in Metasploit which is why it wasn't cracking. Got it the next morning.

[tacit topaz]

Hi ! Can I DM someone about the skill assessment of Web attacks module ?

[fierce atlas]

Sure

[steep sable]

could someone help me with Broken Authentication Weak Bruteforce Protections question two

[maiden slate]

Hey how do you read .txt files from an ftp again? I'm logged in as user and need to read this flag.txt file.

[fierce atlas]

Get the file and read it locally

[mystic perch]

Has anyone finished the Using web proxies module?

[tacit topaz]

If I remember correctly you have to be careful about the header of your request 😉

[tacit topaz]

Yes I have, what's the problem ?

[severe birch]

Anyone able to get me pointed in the right direction? 🙂

[feral gyro]

DM

[rustic sage]

What module is most relevant in the academy for CTF's ?

[tacit topaz]

Any, depend of the ctf.

[broken warren]

Can anyone explain what I'm supposed to comment out in the /etc/nginx/conf/nginx.conf/ the section says to comment out the entire server block. But I see multiple parts that say server. So I'm not sure which one to comment out. The error msg I get is nginx: [emerg] getpwnam ("www") failed in /etc/nginx/conf/nginx.conf:1

[tacit topaz]

You can comment all of them in the http section, be careful of to the opening and the closing of the server section
If you can, send me the file (or a screenshot) in DM to see what the file looks like (with the line numbers)

[fickle copper]

Hello all, I saw that the lfi module was updated and I would like to add 1 more tool for auto-exploitation of lfi vulns which tries all the things in the module and with the capability to gain rce and return a reverse shell directly. Also it is tested on the lfi module. The tool is https://github.com/kostas-pa/LFITester

[lyric mason]

What does exploit -k -z in msf do ?

[west canopy]

@maiden slate you can use the "get flag.txt" command to move the file to your machine, from there you can read it

[livid pier]

🌞

[maiden slate]

TY

[tacit topaz]

Hey ! Can I dm someone about the skill assessment of the file inclusion module

?

[flint ocean]

hi

[livid pier]

Hello!

[lethal atlas]

what up

[lethal atlas]

sure

[livid pier]

@blissful verge @unique valve What you guys think about a pwntools mod?

[tight mesa]

hello everyone, I'm stuck with 2nd exercise in LFI path transversal module

I tried already the commands described in the cheat sheet with no success, any hint?

[blissful verge]

that would be interesting. or maybe part of another module

[tight mesa]

I'm not sure if I allowed to disclose the commands I tried

[lethal atlas]

dm me and we can work thru it

[vital bough]

Can anyone help on the decoding question for using proxies? Like do I need to decode like 100 times or closer to 10?

[west canopy]

@vital bough I think you need to base64 decode a few times. Each time you decode you should see the string getting smaller

[vital bough]

so decoding with 'octal' 5 times in a row is not the right path?

[west canopy]

nope

[vital bough]

oh man I feel dumb I had it but my notepad was counting 32 characters...i just submitted it again and got it

🤦‍♂️

[naive aspen]

Is it possible to reset your progress on a module or overall in the academy?

[heavy edge]

so im working on the HTB academy 'Getting started' part 9 'Public exploits'. i cant ping the target ip in or outside of the pwnbox which means i can not get vulnerabilities, go to the port number or set up MSF

any reason why?

[west canopy]

@heavy edge navigate to the target wit your browser, you should see a wordpress plugin being used. Try attacking that 🙂

[heavy edge]

inside pwnbox or outside?

[west canopy]

with pwnbox

[severe birch]

I am trying to do Windows Priv Esc: Server Operators, am I supposed to be able to view the flag once my user's role appears under 'net localgroup Administrators' or am I supposed to do another step after this? I am having troubles getting the flag.

[west canopy]

@severe birch I believe so , I think I had to disconnect and then RDP back into the machine once I was added to Administrator group. Unfortunately my notes on that section aren't very good 😦

[tight mesa]

anyone can give a hint for the LFI updated version

I'm stuck with the basic bypass

[west canopy]

@tight mesa make you are using the path /index.php?language=languages/

[knotty falcon]

Hi everyone. I could really use some help on the File Inclusion Skills Assessment. I've reached the|| admin panel ||and found the LFI vulnerability that allows me to ||view access.log and error.log|| so I assumed I have to try|| a log poisoning attack to gain command execution.|| However, when I try ||inserting a php command shell in the User Agent Header|| as the instructions show, nothing happens. UPDATE: Got the flag. ||I think using double quotes in the php payload was the problem.||

[tight mesa]

I am

[west canopy]

@tight mesa using four dots and two slashes should do the trick 🙂

[tight mesa]

but the commands from the cheat sheet are not working

uhm this bypass is not working

[west canopy]

Feel free to DM me !

[proud sparrow]

help please, im facing problem with the INFORMATION GATHERING module ACTIVE SUBDOMAINS ENUMERATION section , every question has its problem, i managed to answer the two questions but the third question i tried alot ways to solve it with no results back.

[sweet heron]

any help available for password attacks module? 🙂

[proud sparrow]

help please, im facing problem with the INFORMATION GATHERING module ACTIVE SUBDOMAINS ENUMERATION section ,anyone??

[west canopy]

@proud sparrow which question?

[final salmon]

Anybody online that has gone through the file upload attacks module? Having issues and could use a little assistance

[severe birch]

Ya no luck for me, I know I can get hashes with secretsdump.py but I figured that being in the Administrators group according to 'net localgroup' would give me permissions to view the Administrators folder on its own

[west canopy]

@final salmon Which section ?

[final salmon]

@west canopy The final skills assessment.

[west canopy]

@final salmon DM me 🙂

[severe birch]

I am able to run "klist -li 0:0x3e7 purge" which would require elevation, but still cannot access the Administrator user directory at all

[idle cliff]

Hey guys I'm sort of stuck on the "Using Web Proxies" section where I'm tasked with retrieving the flag using Burp Suite. I can't seem to snag a 200 Ok for the flag in the admin section. Wondering if maybe I've got my burp pointer improperly configured?

Here's what I've got set up so far:

All other settings are as directed in the module with Payload Processing etc

I'm thinking there is something I don't quite understand with the pointer, any help would be appreciated

[west canopy]

@severe birch I was able to get the flag by using wmiexec.py and passing the hash for the Administrator user

@severe birch feel free to DM and i can go into more detail 🙂

[sweet heron]

Getting a syntax error. What am I doing wrong (same command they show in intro to network traffic): sudo tcpdump -r TCPDump-lab-2.pcap proto udp and port 53

[west canopy]

@sweet heron try removing "proto"

the proto option wants an actual protocol number, rather than just a name. So doing "proto udp" makes it error out.

[sweet heron]

right right! So there is an error in the module then.

[west canopy]

well looking at these two examples, in the bottom one they show "proto 17" and mention that the syntax requires proto [protocol number]

[sweet heron]

exactly. But they suggest this:

[west canopy]

ahh nice catch

[sweet heron]

and no sudo too

[west canopy]

yes that is incorrect

[sweet heron]

And for some reason, the first answer won't work. I write XX XXXXX (they even tell you the answer in the file)

[tired cliff]

Hi, I hope I have come to the right place to ask this question, I am really stuck on the Web Requests Module - specifically GET Parameters. The page seems to be broken and I cannot view any of the attached images. I have tried to continue on without it but I think the images are required in order to understand the explanation. I am completely stuck, is there an issue with the course content? or is it most likely my browser.

[west canopy]

@tired cliff I have heard other people report this as well but personally they load fine on my end. Do the images load on any other section?

[tired cliff]

The images with BASH are fine, but images that show web content are not loading

[thin owl]

this happens because when youre connected to the VPN, it creates a default route which doesnt allow internet access to your machine, and some of the code in some of the sites that you connect to load external stuff like googleapi's which you cant reach from the internet

you need to remove the default route that breaks your internet access

http://bobmckay.com/i-t-support-networking/ethical-hacking/hackthebox-vpn-internet-not-working-aka-enable-split-tunneling-on-htb-vpn/

[sweet heron]

Are there any sales sometimes for cubes?

[west canopy]

Not that I have seen

[thin owl]

Also, I found that this may only be the case when you're using the VPN config through your network manager, rather than via using the config file and openvpn from the terminal

[tired cliff]

I have tried logging into HTB Academy from Edge, Chrome and Firefox, i have stopped all extensions and have cleared cache and cookies... and all of them display the same broken images. I have done had a bit of a look using Dev tools and when I try to open the images independently i get a 404 error message. I am very new to the whole thing and am very... very limited to what i can do and my troubleshooting knowledge. I have not had any issues with other modules.. just this one. I would really like to finish this module.. im dying inside hah hah hah.

[west canopy]

@tired cliff DM me and i can send you the pics from the sections

[rustic sage]

hey anyone give me a nudge in Intro to Network Traffic Analysis :Tcpdump Packet Filtering

im assuming i have the right filter i just cant figure out how it wants it.... if that makes sense?

[west canopy]

@rustic sage try doing: host 10.10.20.1

[rustic sage]

aahhhh to many zeros.... thanks man!!!

[pallid fulcrum]

The module "BUG BOUNTY HUNTING PROCESS" should be a free module, it's really a copy paste from the hackerone website. I fill scamed to spend 50 cubes for it!

[deep spruce]

Hey i'm new on HTB academy I have a quesion about
Stack-Based Buffer Overflows on Linux x86
Because i'm stuck on a question
is that where I need to ask?

[kind turret]

@deep spruce It is 😀 Just wait until someone that has done the module to come and help you with it.

@deep spruce I have personally finished the "Stack-Based Buffer Overflows on Windows" module not the Linux one.

[deep spruce]

Uh that's not a hard question, that's about bytes format x)
And i'm a bit lost about this 😅
Maybe can i pm you if you have some time

[kind turret]

Sure sure

[mellow whale]

Good catch you two! Fixed the error in the text.

[lethal atlas]

Good morning everyone. (At least here)

[unique valve]

Good morning 😁

[lethal atlas]

How is your day?

[drifting knoll]

Sorry to hear that you are not satisfied with this module. It is important to understand that this module served as the guidance point in collaboration and arrangement with HackerOne for the Bug Bounty Hunter Path. It is meant as a pathway for students to understand all modules of that path to real-world bug bounty hunting processes and procedures, which is essential for everyone participating in this path and certification.

[tacit topaz]

Hi all ! I'm currently stuck on the session security skills assessment, anyone can dm me to help a little ?

[unique valve]

Its going good so far. Hows yours?

[lethal atlas]

I feel this will be a good day. I should finish the Bug Bounty Path today. 😄

[zealous fiber]

Hello, can someone help me with Web Service & API Attacks - Skills Assessment ? Kinda stuck here. I think the Attack Vector ist the Login operation, a little hint would be nice

[tight mesa]

hello everyone, who can give a hand with this terminal behavior

[lethal atlas]

I am working that module now as well. DM me anb maybe we can work thru it together

[lethal atlas]

whats the issue?

[tight mesa]

when I'm traying to copy the base64 portion encoded php.ini file to grep allowed_url_encoded my terminal is dead

currently I'm working with PHP wrappers under LFI module

[lethal atlas]

and you used this example?

I understand your trying the portion above but in this case you don't need to check if its on.

[tight mesa]

ok., maybe for this exercise it isn't necessary but, what happen in a real assessment?, how can I handle it?

[lethal atlas]

Are you using your own vm?

[tight mesa]

yes

[lethal atlas]

what is the target IP and port and I will run the command

[tight mesa]

curl http://165.22.122.134:31247/index.php?language=php://filter/read=convert.base64-encode/resource=../../../../etc/php/7.4/apache2/php.ini

[lethal atlas]

i get connection refused

[tight mesa]

sorry this session is dead

let me start another one, one more time

[lethal atlas]

I spawned it myself and it only took a couple of seconds to get the code

[tight mesa]

what do mean it?

[lethal atlas]

"it" the target

[tight mesa]

ok.

[lethal atlas]

I used the same command you used so it is definitely something with your term

[tight mesa]

ok., are you using the spawn machine or your own VM?

in case you're using your own VM, your term is Terminator?

well I tried with the terminal emulator not terminator and I had the same behavior

[lethal atlas]

I use a Kali Vm with terminal emulator

[tight mesa]

um ok this is weird

I'm using the same

[lethal atlas]

yeah I am not sure. Are you fully updated?

I use this command almost daily... sudo apt update && sudo apt upgrade -y && sudo apt autoclean && sudo apt autoremove -y && sudo updatedb

[tight mesa]

um not daily

let me tried

[lethal atlas]

you could always try qterminal, mate terminal or lxterminal

[tight mesa]

well I guess I was working under a not very updated VM

LoL

[lethal atlas]

lol

[tight mesa]

if I made any misspelling or grammar mistake, my apologies cause English is not my first language..!!!

[lethal atlas]

I dont worry about anyones english. I understand that people come here from all over the world which is what makes this great. We can always work around language.

[tight mesa]

sweet

[distant stream]

Dm if you still need help

[livid pier]

[storm shore]

hello, under webrequests module i am having trouble knowing what i need to do.
the question:
Send a GET request to the above server, and read the response headers to find the version of Apache running on the server? (answer format: X.Y.ZZ)

i have spawned the target 68.183.45.211:30832

but when i try to write curl 68.183.45.211:30832 -v
the connection timed out

i dont get anything, what should i be doing?

[lethal atlas]

use burp

[autumn pilot]

don't forget the verb that needs to be sent as

[storm shore]

i resetted the target and it worked now. but thanks for the response 🙂

[storm shore]

what is burp?

[lethal atlas]

BurpSuite Its talked about all thru the module

then again in the updated module maybe it isnt mentioned but it is used in most modules

[storm shore]

hmm, i dont think i have seen it. is it in the terminal i have?

[storm shore]

virtual machine*

[lethal atlas]

its on pwnbox and kali vms by default

[storm shore]

okay 🙂 all i have seen is the curl thing. it is the first time i am ever doing something like this so, i might not have seen it 😄

[lethal atlas]

Yeah, the new updated module is completely different from the one I completed.

[night zealot]

Hi guys, somebody did the bug bounty hunter exam?

[lethal atlas]

yes

[night zealot]

How it was? It easy just following the modules' materials?

[lethal atlas]

oh lol I didnt take it yet but @low dirge did and passed.