HauntMart Web Challenge (Easy Difficulty)

CHALLENGE DEFINITION

The challenge in question involves an e-commerce website so the goal here is to sell items and I believe the challenge description makes this clear.

HauntMart, a beloved Halloween webstore, has fallen victim to a curse, bringing its products to life. You must explore its ghostly webpages, and break the enchantment before Halloween night. Can you save Spooky Surprises from its supernatural woes?.

SOURCE CODE ANALYSIS

I think one of the things that should stand out about a first release is the fact that the application can be accessed via a URL; in the route.py file.

and we can thus see that we have a download function that certainly uses our URL.

Consequently, after analyzing the **download** function, we can see that its purpose is to download and execute files based on the value provided in the URL parameter.

However, there is a minor issue involving a filter that checks whether the user's IP address is localhost.

Therefore, what we need to do is utilize the **addAdmin** API endpoint to add our username to the list of admin users.

The addAmin function

Here, then, is the payload we will use for the URL input.

http://0:1337/api/addAdmin?username=test

http://0:1337/api/addAdmin?username=test

For this payload, we had to use http://0 to bypass the IP restriction.

And right after entering the URL, we can log in and log out.

and as a result, we were able to get our flag,we can now use it to complete the challenge.

That's all for this challenge,see you in the next ones.