https://ircgod.com/tags/htb/ Recent content in HTB on ./ircgod.com Hugo en-US Tue, 06 Dec 2022 12:14:59 +0200 https://ircgod.com/posts/batchcraft-potions/ Tue, 06 Dec 2022 12:14:59 +0200 https://ircgod.com/posts/batchcraft-potions/ <p>A web challenge ranked &ldquo;medium&rdquo; in the HTB university CTF</p> <p>Challenge description:</p> <p><img src="https://ircgod.com/posts/batchcraft-potions/images/challenge.png" alt="challenge description"></p> <p>Compared to the easy web challenge this one gave us a lot more trouble, we bypassed the 2fa in about 2h/3h hours then got stuck from friday ~7pm to sunday ~14pm.</p> <h2 id="initial-recon">Initial recon</h2> <p>We perform a pentest in a white box environment and have access to a nodejs website.</p> <p>The web server in use is express, we can access the app via an nginx reverse proxy wich ratelimit some endpoint.<br> The database is a mysql (mariadb) database and it is sometimes using graphql.<br> It is using JWT for authentication.</p> https://ircgod.com/posts/the-magic-informer/ Mon, 05 Dec 2022 12:14:59 +0200 https://ircgod.com/posts/the-magic-informer/ <p>A web challenge ranked easy in the HTB university CTF</p> <p>Challenge description:</p> <p><img src="https://ircgod.com/posts/the-magic-informer/images/challenge.png" alt="challenge description"></p> <p>I started doing web things about a month ago so i am still a begginner but i easily flagged this one and did a big part of the medium one so i am still happy about my performance.</p> <h2 id="initial-recon">Initial recon</h2> <p>We perform a pentest in a black box environment and have access to a website probably built in nodejs (Wappalyzer).</p>