Hammer
Check out the Medium blog post here:
Overview
This challenge room presents an interesting mix of issues such as information exposed within the source code, and vulnerabilities with authentication mechanisms.
SPOILERT ALERT: the list below displays an overview of the vulnerabilities.
The following is an outline of the vulnerabilities presented in this CTF:
Information exposure in source code
Vulnerable rate limiting logic
Vulnerable JWT implementation
Trying to access port 80
failed, port 80 not open
Using nmap to discover web application port
found port 1337 (labelled as waste, but is actually running a HTTP web server)
Initial view
Login page
Upon visiting the base URL (/), I was presented with a login page. Below the form, there is a link to a reset password page that accepts an email address. It appears that we have to find an email address that is used in the application.
Last updated