πŸ“•
Blog
  • 🐞Vulnerabilities & Techniques
    • Web Vulnerabilities
      • Open Redirect
      • HTTP Parameter Pollution (HPP)
      • Host Header Injection (HHI)
      • XSS
      • HTML-Injection
      • clickjacking
      • S3
      • EXternal Xml Entity (XXE)
      • XSS prevention | CSP
      • DOM-XSS
      • SQL Injection | SQLI
      • Response Manipulation Technique & How Burp Suite Works
    • API Vulnerabilities
      • Mass Assignment Vulnerability
  • 🚩CTF
    • ASCWG
  • ✍️Writeups
    • Read Writeups
      • REST API WriteUps
      • Web Vulnerabilities WriteUps
    • Technical Writeups
      • Reset Password Poisoning Via Host Header Injection Lead to (ATO)
      • OTP/2FA Bypasses
        • OTP bypasses
  • 😈TryHackMe
    • THM Advent of Cyber 3 (2021) NoSQL WriteUp
  • πŸ”±Web-CyberTalents
    • CyberTalents-Web-Easy
    • CyberTalents-Web-Medium
    • CyberTalents-Web-Hard
  • πŸ–‡οΈPentesting & Bug Hunting Tips
    • ATO Via Host Header Injection
    • OTP Bypass
    • OutLook Plugin Pentest Guide
  • πŸ’»Port-Swigger Labs
    • XML external entity (XXE) injection
    • DOM-XSS
      • DOM XSS in the document.write sink using source location.search
      • Lab: DOM XSS in document.write sink using source location.search inside a select element
      • Lab: DOM XSS in innerHTML sink using source location.search
      • Lab: DOM XSS in jQuery anchor href attribute sink using location.search source
      • Lab: Reflected DOM XSS
      • Lab: Stored DOM XSS
    • SQL injection
      • Lab: SQL injection vulnerability in WHERE clause allowing retrieval of hidden data
      • Lab: SQL injection vulnerability allowing login bypass
      • Lab: SQL injection UNION attack, determining the number of columns returned by the query
      • Lab: SQL injection UNION attack, finding a column containing text
      • Lab: SQL injection UNION attack, retrieving data from other tables
      • Lab: SQL injection UNION attack, retrieving multiple values in a single column
      • Lab: SQL injection attack, querying the database type and version on Oracle
      • Lab: SQL injection attack, querying the database type and version on MySQL and Microsoft
      • Lab: SQL injection attack, listing the database contents on non-Oracle databases
  • πŸ›œWireless Networks Penetration Testing
  • βš”οΈWi-Fi Attacks
    • πŸ•ΈοΈNetwork Scanning attack
    • 🌊DOS / Flooding
      • 1️⃣DoS - Frame Flooding (Deauth, EAPOL, Beacons)
      • 2️⃣DoS- Exploiting Countermeasures (MIC failure)
    • Jamming Attacks (Ω‡Ψ¬Ω…Ψ§Ψͺ Ψ§Ω„Ψͺشويش)
    • Probe Requests Attack
    • Handshake Attacks
      • Dictionary Attack
      • Clientless Attack
      • KRACK Attack
      • Downgrad Attack
    • Rouge AP Attack
  • Lab Notes
  • RFID and NFC
  • Bluetooth
  • ZigBee
  • Google Map Test
Powered by GitBook
On this page
  • ASCWG 2020 Web Challenge G(old)
  • Quick links
  1. CTF

ASCWG

PreviousCTFNextWriteups

Last updated 2 years ago

ASCWG 2020 Web Challenge G(old)

​Cyber WarGames 2020OverviewTogether with my friendMohamed Midowe have been able to solve this challengeChallange Desciption:Difficulty: EasyPoints: 300 pointCategory: WebChallange Link: 10.0.0.5 on LAN Network it is not Available Onlinevulnerability :SSI​Stepsunderstanding the web appGo to 10.0.0.5you will get this login FormAfter making some routing search on this page like: show source Code, Request, resopsne and Cookies i didn’t find any thing can catche my attention.so,first thing I tried deafault credentials like admin:admin​​

  • you will get welcome message with the value of $_POST[β€˜name’]

  • ​

  • i didn’t gey Anything useful

  • Notice red rectangle around file Name and extension .shtml

  • return to Login Form

  • try Login using anything you will login i will try login with yasser:yasser or xss payload will work but not return with flag or any thing

  • ​

  • you will notice that file name was change again

  • and still with shtml extension

What is shtml ?

  • ​

  • ​

  • ​

  • you can using any scanner like burp scanner To be sure

Exploit SSI to get the Flag

  • Fire Burp Suite and injecti payload , What Happend?

  • ​

  • Click Follow Redirection

  • ​

  • Bing0o0o0o0o we got flag file

  • let’s try to display this file to get the flag

  • https://i.ibb.co/Bw3TvB8/redirect-2.png

  • Click Follow Redirection Again

  • Bingo0o0o0o we Got The Flag

  • ​

Quick links

Kourama

Penetesting, Bug Bounty, CTF player.

open first and read it

so it may be Server Side Injection

So i will seearch about ​

🚩
link
SSI
SSI payloads