TryHackMe : OWASP Top 10

OWASP Top 10 Writeup

  • Name: OWASP Top 10
  • Description: Learn about and exploit each of the OWASP Top 10 vulnerabilities; the 10 most critical web security risks.
  • Room: tryhackme.com

Task 5-[Severity 1] Command Injection Practical

What strange text file is in the website root directory?

drpepper.txt

How many non-root/non-service/non-daemon users are there?

0 (“cat /etc/passwd command,
it seems there is no non-root/non-service/non-daemon users.”)

What user is this app running as?

www-data

What is the user’s shell set as?

cat /etc/passwd | grep www-data | cut -d ‘:’ -f 7

/usr/sbin/nologin

What version of Ubuntu is running?

cat /etc/os-release

18.04.4

Print out the MOTD. What favorite beverage is shown?

Dr Pepper (“ls -1 /etc/update-motd.d/”)

Task 7-[Severity 2] Broken Authentication Practical

What is the flag that you found in darren’s account?

fe86079416a21a3c99937fea8874b667

What is the flag that you found in arthur’s account?

d9ac0f7db4fda460ac3edeb75d75e16e

Task 11-[Severity 3] Sensitive Data Exposure (Challenge)

What is the name of the mentioned directory?

/assets

Navigate to the directory you found in question one. What file stands out as being likely to contain sensitive data?

webapp.db

Use the supporting material to access the sensitive data. What is the password hash of the admin user?

6eea9b7ef19179a06954edd0f6c05ceb

Crack the hash.
What is the admin’s plaintext password?

Crack the password with crackstation.

qwertyuiop

Login as the admin. What is the flag?

THM{Yzc2YjdkMjE5N2VjMzNhOTE3NjdiMjdl}

Task 13-[Severity 4] XML External Entity — eXtensible Markup Language

Full form of XML

Extensible Markup Language

Is it compulsory to have XML prolog in XML documents?

no

Can we validate XML documents against a schema?

yes

How can we specify XML version and encoding in XML document?

XML prolog (“Above the line is called XML prolog and it specifies the XML version and the encoding used in the XML document”)

Task 14-[Severity 4] XML External Entity — DTD

How do you define a new ELEMENT?

!ELEMENT

How do you define a ROOT element?

!DOCTYPE

How do you define a new ENTITY?

!ENTITY

Task 16-[Severity 4] XML External Entity — Exploiting

What is the name of the user in /etc/passwd

falcon

Where is falcon’s SSH key located?

/home/falcon/.ssh/id_rsa

What are the first 18 characters for falcon’s private key

MIIEogIBAAKCAQEA7

Task 18-[Severity 5] Broken Access Control (IDOR Challenge)

Look at other users notes. What is the flag?

http://MACHINE_IP/note.php?note=0

flag{fivefourthree}

Task 19-[Severity 6] Security Misconfiguration

Hack into the webapp, and find the flag!

default account => pensive : PensiveNotes

thm{4b9513968fd564a87b28aa1f9d672e17}

Task 20-[Severity 7] Cross-site Scripting

Navigate to http://MACHINE_IP/ in your browser and click on the “Reflected XSS” tab on the navbar; craft a reflected XSS payload that will cause a popup saying “Hello”.

<script>alert("Hello")</script>

ThereIsMoreToXSSThanYouThink

On the same reflective page, craft a reflected XSS payload that will cause a popup with your machines IP address.

<script>alert(window.location.hostname)</script>

ReflectiveXss4TheWin

Now navigate to http://MACHINE_IP/ in your browser and click on the “Stored XSS” tab on the navbar; make an account.

Then add a comment and see if you can insert some of your own HTML.

<b>noraj is bold</b>

HTML_T4gs

On the same page, create an alert popup box appear on the page with your document cookies.

<script>alert(document.cookies)</script>

W3LL_D0N3_LVL2

Change “XSS Playground” to “I am a hacker” by adding a comment and using Javascript.

<script>document.querySelector("#thm-title").textContent = "I am a hacker"</script>

websites_can_be_easily_defaced_with_xss

Task 21-[Severity 8] Insecure Deserialization

Who developed the Tomcat application?

The Apache Software Foundation

What type of attack that crashes services can be performed with insecure deserialization?

Denial of Service

Task 22-[Severity 8] Insecure Deserialization — Objects

Select the correct term of the following statement:

if a dog was sleeping, would this be:

A) A State
B) A Behaviour

A Behaviour

Task 23-[Severity 8] Insecure Deserialization — Deserialization

What is the name of the base-2 formatting that data is sent across a network as?

Binary

Task 24-[Severity 8] Insecure Deserialization — Cookies

If a cookie had the path of webapp.com/login , what would the URL that the user has to visit be?

webapp.com/login

What is the acronym for the web technology that Secure cookies work over?

HTTPS

Task 25-[Severity 8] Insecure Deserialization — Cookies Practical

1st flag (cookie value)

echo ‘gAN9cQAoWAkAAABzZXNzaW9uSWRxAVggAAAAYzdkYzQ0ODM4ZTA4NDdiMWI0NTU0NDk0OGE5MmQxOTRxAlgLAAAAZW5jb2RlZGZsYWdxA1gYAAAAVEhNe2dvb2Rfb2xkX2Jhc2U2NF9odWh9cQR1Lg==’ | base64 -d

THM{good_old_base64_huh}

2nd flag (admin dashboard)

THM{heres_the_admin_flag}

Task 26-[Severity 8] Insecure Deserialization — Code Execution

flag.txt

4a69a7ff9fd68

Task 29-[Severity 9] Components With Known Vulnerabilities — Lab

How many characters are in /etc/passwd (use wc -c /etc/passwd to get the answer)

1611

Task 30-[Severity 10] Insufficient Logging and Monitoring

What IP address is the attacker using?

49.99.13.16

What kind of attack is being carried out?

Brute Force

thank you 🌏🔥

--

--

--

Computer student and interested in programming and security

Love podcasts or audiobooks? Learn on the go with our new app.

Recommended from Medium

Lean Analytics Using Your Existing Jira Instance

Mars Ecosystem Weekly Report #36

Spring boot -cucumber-BDD

New Golem: Alpha II reveal — we’re ready for you to come build with us!

Release Management

Centralized Logging With Elasticsearch, Kibana, Logstash and Filebeat

In Defense of Stack Overflow

Lawyers in Utah

lawyers in utah

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store
Hassan Mohammadi

Hassan Mohammadi

Computer student and interested in programming and security

More from Medium

[EN] TryHackMe 25 Days of Cyber Security: Day 7 Walkthrough

Authentication Basic in 3 minutes

TryHackMe : OVERPASS Walkthrough