Book

I could use a little nudge on initial foothold. I’ll share what I have tried so far.

Got a little tidbit but probably not useful after hitting the URI length limit.
Thought Dea* **ef might be good for debugging or buffer overflow but it turns out it is just a piece of static information about the server.

Just to confirm, to successfully login in the admin page, you need to guess the password as for the Sauna box or there is somewhere a vuln that allows you to bypass the authentication?

Spoiler Removed

Type your comment

Type your comment> @syn4ps said:

Just to confirm, to successfully login in the admin page, you need to guess the password as for the Sauna box or there is somewhere a vuln that allows you to bypass the authentication?

Why not creating your own one instead of guessing :slight_smile:

the L******** its not working… :confused: please someone help me… Discord: SuPerCoW#8100

For everyone using automated tools like sqlmap and burp. Do not use these kind of scanners. You only fill the machine with bloat and it does not give you any help whatsoever.

Box rooted this morning… it does not worth at all 30 points!!! I don’t know who is deciding the value of boxes but he/she needs to re-evaluate it. (On my opinion, it worths at least 50 points)

Any way… not to spam the thread with hints already given, I offer my help in private messages.

Hint : I liked Trunk Dragon Ball :slight_smile:

What is the difference between admin and user? Enumerate more and try more, learn from every box.

If you managed to automate the ‘payload sending’ via python please message me… It works in firefox, but curl and/or python requests fails miserably and I want to understand why.

Nice box.

Had some troubles and had to ask for some nudged, but the techniques were completely new to me. So learned at least 3 completely new things on this box.

Was frustrating at start, but overall good versatile box.

Cool box

Thanks to @alez and @bertalting for helping with the login in the admin panel

For user:

  • everybody was talking about it, it wasn’t possible at first but now, maybe that report generator could trigger it

For root:

  • Services
  • 1, 2, 3… GO! *Formula 1 car sound*

really nice box :smile:

I’m going absolutely mad about the admin login. Can anybody nudge me pls?

@targodan said:

I’m going absolutely mad about the admin login. Can anybody nudge me pls?

Same!

Can anyone provide a nudge for getting access to the admin control panel? Struggling to make any progress on this one.

@bertalting told an interesting hint for the foothold ! thank you

The get admin is necessary a trunk.

Giving up