Hacking Write-Ups

Let’s Start with this !! So here is the challenge Just viewed the source code as source code sometimes reveals useful information Searched for password in the code and got one result While looking carefully i got something i.e password as 9286jas Successfully logged in using the above password

Let’s Start with this !! So here is the challenge Just viewed the source code as source code sometimes reveals useful information Searched for username in the code and got two results of username . While looking carefully i got something i.e a directory ( ../../extras/ssap.xml ) Now copied the directory and pasted it in browser after the url of main challenge page URL : https://www.hackthis.co.uk/levels/main/4/../../extras/ssap.xml Results : Got something . yeah !! Got the username and password

Lab Environment Attacker’s Machine : Linux kali 4.18.0-kali2-amd64 #1 SMP Debian 4.18.10-2kali1 (2018-10-09) x86_64 GNU/Linux Vulnerable Machine : Covfefe: 1 Let’s start hacking and breach the security of this machine Scanning Phase : Let’s start with knowing our attacking machine’s ip          Syntax used : ifconfig                 Results : 192.168.169.129 Now let’s scan our local network to which attacking machine and vulnerable machine is connected.        Syntax used : arp-scan --local Enumeration Phase : Now using nmap to scan the services running on ports .      Syntax used : nmap -p- -A 192.168.169.132 -Pn Results : http service is running on port 80 and 31337 Now browsing ip in desired browser to see the webpage on port 80 Browsing ...

Lab Environment Attacker's Machine - Linux kali 4.18.0-kali1-amd64 #1 SMP Debian 4.18.6-1kali1 (2018-09-10) x86_64 GNU/Linux Vulnerable Machine - Android 4 Proof Of Concept Scanning Phase arp-scan --local (to scan for the machines connected to the network) vulnerable machine IP - 192.168.169.130 Now i will use nmap for further scanning the machine's IP nmap -p- -A 192.168.169.130 -Pn Now i tried to access the IP on port 8080 In nmap scan we got result of dropbear which is used for connection with client and server So i used adb for that to get connected to the server I installed adb by simply apt-get install adb Now fired up msfconsole and searched for adb and got one exploit to get the connection from server Used that exploit : Syntax used : use exploitname Exploring the requirements for exploit to run Fulfilled the requirements as follows and simply run the exploit by typing run Now connecting adb...

Note  :  You need to understand a logic in code. Beginning with this challenge . After the welcome page of challenge 3 I viewed the source code of page by ctrl+u Highlighted line of code is using if : else condition i.e if username = heaven and password = hell else alert incorrect login. Explanation : if username = heaven , password = hell it will authenticate otherwise not . So providing username as heaven and password as hell Completed successfully

Let’s do this one more easy level . Let’s get started I first opened the source code but found nothing so i selected all the webpage with ctrl+a And got the details . Username : resu Password : ssap And tried to login with the creds and yeah completed the challenge

It's damn easy !! Prompted with challenge 1 There’s a warning saying you don’t have to enter your credentials so it means there is a twist .. I just viewed the source code by ctrl+u and searched for username by ctrl+f(helps in finding our desired word) Now got the username as in and password as out . Tried to enter the same creds And yeah challenge completed with an ease !