[Web] Lernaean

Well that was frustrating. I was sure the flag was right, but it wouldn’t accept. Look at it from a different perspective and it all made sense.

Im still having trouble with the 2nd part, im looking at the response but I dont know what to look for.

I am stuck at the first part.

  1. How many passwords am I supposed (and allowed) to bruteforce?
    I wrote a simple Javascript script and tried all passwords in
    http://downloads.skullsecurity.org/passwords/john.txt.bz2
    and
    http://downloads.skullsecurity.org/passwords/500-worst-passwords.txt.bz2
    HackTheBox rules state that “Any form of DoS (Denial of Service) is forbidden” so I am a bit hesitant to bruteforce the whole rockyou set.
  2. People here write about using Hydra and Burp. Is there something special about using those programs or is it just a way not to write your own bruteforcing script?

Update: Password is found but the first questions remains for other challenges of the site: how much am I allowed to bruteforce?

Update 2: Solved but the questions remain

@nns2009 said:
I am stuck at the first part.

  1. How many passwords am I supposed (and allowed) to bruteforce?
    I wrote a simple Javascript script and tried all passwords in
    http://downloads.skullsecurity.org/passwords/john.txt.bz2
    and
    http://downloads.skullsecurity.org/passwords/500-worst-passwords.txt.bz2
    HackTheBox rules state that “Any form of DoS (Denial of Service) is forbidden” so I am a bit hesitant to bruteforce the whole rockyou set.
  2. People here write about using Hydra and Burp. Is there something special about using those programs or is it just a way not to write your own bruteforcing script?

Update: Password is found but the first questions remains for other challenges of the site: how much am I allowed to bruteforce?

Update 2: Solved but the questions remain

you don’t need bruteforce, try to understand how login work on this website

@justromeo said:
you don’t need bruteforce, try to understand how login work on this website

Do you want to say that this challenge allows multiple solutions?
I would assume that challenges not designed to be bruteforced would have strong enough password

@nns2009 said:

@justromeo said:
you don’t need bruteforce, try to understand how login work on this website

Do you want to say that this challenge allows multiple solutions?
I would assume that challenges not designed to be bruteforced would have strong enough password

This challenge is designed to be brute forced. I’m not sure there’s a hard and fast rule on DoS (for challenges), but there are definitely some challenges where throwing rockyou at the running service is the correct thing.

Solved it in a minute. Feel free to ping me up if you need guidance.

@FloptimusCrime said:

@atti said:
Spoiler Removed - Arrexel, can’t get the second part. I am intercepting but I can’t find the redirect.

Check all the tabs in burp proxy

Guys that are logged in and are stucked should really follow @FloptimusCrime responses, check all tabs in burp intercept response tab

The tips are on the login page, read carefully, after completing the first part, intercept the request and use the head, if necessary, repeat.

I Use hydra and burp to do this.
PM if u need a tip :slight_smile:

If you need subtle hints and some education with it, feel free to PM :smiley:

I’m using Burp and Hydra, but can anyone point me to a tutorial/ hints on how its done so much faster, there must be another way the brute forcing it.

@GChester google out Lernaean.

Problem solved. I’d got my syntax wrong…

solved, instructive challenge

so easy
dont complicate things once you got the password you will get the flag

Cool challenge learnt something new. Reading is important in this one.

I’ve started Hydra with rockyou list. Am I doing it right? I’m wondering how long I should wait for it to find the password. I’ve been waiting for 20 minutes, still no result. Is it ok?

I struggled a bit with this one, but I would give some advice, use Hydra to get the password for the login, then Burp Suite for the next part, good luck!

hummm Hydra give me 16 valid pass and none is good, its that possible?? i use rockyou.txt, download of a one page…