Web Application Penetration Testing CTF 1

Hello folks! Today we'll be discussing about one more CTF challenge of the Web Application Penetration Testing as always I'll not share the flags values because i want you to learn, rather than just submitting the flags on the platform. I will share the commands,tools I used to enumerate all the services and the methodology I used to gather all the flags. I think this would be the last CTF challenge of the eJPT learning path but not the last ctf challenge and not the last walk through, I will keep sharing new concepts CTF walk throughs and other things regularly so keep supporting me So lets get started …….

Flag 1: Sometimes, important files are hidden in plain sight. Check the root ('/') directory for a file named 'flag.txt' that might hold the key to the first flag.

The first thing I did is access the target on the web browser and we see a web application running on the target that displays a list of files that can be downloaded via web app, but we cant change the name of files

so what did is I tried to change the file names within the url to check if i can find any files in the web root directory ,but the hint clearly mentions about the first flag in the root directory so tried heading back to directories using ../../ and after few attempts i found the flag {a classic example of LFI(local file inclusion)}

Flag 2: Explore the structure of the server's directories. Enumeration might reveal hidden treasures.

The hints clearly mentions that we have to enumerate the directories on the web server and by using gobuster within few seconds we got the hidden directories

after accessing the directory we can see the flag file listed in the directory

Flag 3: The login form seems a bit weak. Trying out different combinations might just reveal the next flag.

we have to enumerate a user password to get the flag ,I used burp intruder to bruteforce username against passwords.

the first thing we have to configure is attack type : cluster bomb (every single possibility using two wordlists) , then we have to select the appropriate fields that are to be brute forced

then we have select the payload set ,1 for the first payload (username) and 2 for the second payload (password)

Once you have configured the attack ,you can hit attack to start the cluster bomb attack.

after few minutes you will receive a response with different length as compared to other responses.

now we can use the credentials to login to the application.

Flag 4: The login form behaves oddly with unexpected inputs. Think of injection techniques to access the 'admin' account and find the flag.

The hint clearly mentions about sql injection

using the basic injection on the username field gives us the success response

once we have identified the proper injection we can now use to login to the system using admin to get last flag.

And that was for today ….Happy Hacking !!!!