THM Advent of Cyber 3 (2021) NoSQL WriteUp
The advent of Cyber 3 (2021) [Day 7 - NoSQL]
[Day 7] Web Exploitation Migration Without Security
Credits: RealTryHackMe
Please Read Day 07 About NoSQL
First Flag
Q: Interact with the MongoDB server to find the flag. What is the flag?
As you read turn on your Machine
Open Terminal
Type ssh thm@MACHINE_IP -p 2222
As you read in This room on day 07
Do the same steps as the image Below
login ssh
Interact with Mongo DB
show your databases
Use flagdb DataBase
So now you are in flagdb Database
List All Collections == Tables
Will Find flag Column == Fields in this Records == Documents
Second Flag
Q: Interact with the MongoDB server to find the flag. What is the flag?
Open http://MACHINE_IP
Try to inject dummy data in username and password Fields
Fire up Your Burp
Intercept the Request after sending username and password Inputs Fields
As you read in This room on day 07
As You learned send username parameter with admin
Change the password parameter to anything
Parameter password[$ne]=anything
$ne == Not Equal
To make all statements Like True as SQLI
Username is admin & Password not equal anything == [TRUE]
The response will be 302 Found
Press Follow Redirection
You will find the flag Directory
Click Right and Choose Copy Response Link from burp response in the repeater
Paste the Link in the Browser and click on flag link
Third Flag
Q: Once you are logged in, use the gift search page to list all usernames that have guest roles. What is the flag?
After login, you will see search link
Search with any dummy data
As you read in This room on day 07
Change GET Parameters username & role to be TRUE
How to make it True First and Second Parameter each parameter should be TRUT to make all Request True
Username Paramter Not Equal admin == anyusername
Role Parameter Not Equal admin also == Role=guest
From 7,8 The Request will be True To get All guest's Usernames Not Admin
The Response Will Retraive The THM flag
Fourth Flag
Q: Use the gift search page to perform a NoSQL injection and retrieve the mcskidy record. What is the details record?
After login, you will see search link
Search with any dummy data
As you read in This room on day 07
Change GET Parameters username & role to be TRUE
How to make it True First and Second Parameter each parameter should be TRUT to make all Request True
Username Paramter Value mcskidy
Role Parameter Value Not Equal admin also
But I didn’t ant flag in response
Change Role Parameter Value Not Equal admin guest == Role=admin
From 7,10 The Request will be True To get mcskidy Username with Admin Role
The Response Will Retraive The THM flag
Last updated