API ATTACKS Skills Assessment

HTB Content Academy
1

Has anyone else had any luck with solving this. I have enumerated the supplier with a security question set but have not had any luck brute forcing the password reset through the security question.

Thank you :slight_smile:

2

If your like me, You just need a really big wordlist.

A hint is that it is a fairly popular programing language :stuck_out_tongue:

3 Likes
4

can u provide the wordlist ? cuz have been searching for one

5

Just to point out that the attention to detail matters a lot here, sp make sure to take your time and carefully inspect each response.

Another tip that I would give is to search and find different wordlists when trying a brute-force attack at any point.

1 Like
6

find the color wordlist on github. If all goes well then you just got to change the supplier logins

7

Hello. I will like to know if this discussion is about the new module for API attack assessment ? Because the discussion seems to be different from the difficulties I am facing. I am having the same error message when trying to upload a pdf file. Has anyone solve this ?

1 Like
8

Yes, Try uploading the pdf file not as the customer but as a supplier. Get a way to authenticate yourself as a supplier from the password reset options available. Let me know if you need further assistance. Cheers

9

Thanks for the tip. I will try that.

1 Like
10

okay.

11

Hi everyone, I’m stuck with this task right now. I brute-forced the user, uploaded a PDF, and am trying to use it to update and view /etc/passwd, but nothing is working.

{
  "successStatus": false,
  "base64Data": "An error occurred while reading the file."
}
1 Like
12

are you reading the /etc/passwd as a customer or as a supplier.

13

as a supplier

14

i have only 2 acc Br**don R*gers and htbpentester

15

Wait… this is the skills assessment right?

16

yep

1 Like
17

I also didn’t understand the clue of the guy who said it’s a popular programming language, maybe that’s why I’m stumped.

18

Hey I was making the same mistake. Read the question again at the bottom of the skills assessment page, it’s not asking you to get the base64 from the /etc/passwd file path, it’s asking you something else. Hope this helps!

19

Does the list of colors need to be mutated or is the password all lower case?

Nevermind, worked it out :slight_smile:

20

jq the list of suppliers and select(.securityQuestion != “SupplierDidNotProvideYet”).

You’ll end up with around 5 potential targets and all have the same question (which hints at what you should fill your wordlist with). I only had 75 words in my list.

21