I have got the access to the web application but not able to get the next entry point. Can anyone give me a hint? What to do after successfully logged in to the application.
entry bruteforce or bypass ? i have been trying both for days now
@princeade said:
entry bruteforce or bypass ? i have been trying both for days now
Navigate all pages and sometime you will get a big hint in the source code.
all pages?? hmm it’s just a login page… will keep checking though
@princeade said:
all pages?? hmm it’s just a login page… will keep checking though
Its the most common vulnerability for bypassing login page.
this is weird, an sqlinj bypass leaked a username, but didnt log me in? hmmm…
@wolverine said:
this is weird, an sqlinj bypass leaked a username, but didnt log me in? hmmm…
Same here. Stuck at this very point.
Hints?
Guys, i can not access the admin account, I injected him but can not get his sid.
I am also stucked, because of the httpOnly flag …
got the username and password for the web. what now 
help 
I don’t want to be rude but I the only appropriate answer here seems to be : enumerate.
I think its fair to ask about “HOW” to do something … but “WHAT” …
If you don’t know what to do you just need to enumerate more.
Any other answer is just a spoiler, no ?
just need a direction like is it sql injectable or XSS injectable or something else to get a foothold to the system 
not spoilers. just need a big picture of what kind of vulnerability to get into the system.
@Linoge said:
just need a direction like is it sql injectable or XSS injectable or something else to get a foothold to the system
did you ever got it? im about to head into this machine.
Only for me dirbuster doesn’t work?
Try to figure out what’s different. So why isn’t dirbuster working for you when a browser is.
@li0nheart said:
Try to figure out what’s different. So why isn’t dirbuster working for you when a browser is.
Yeah I understood that, but don’t know how to enumerate
@MrRobotty said:
@li0nheart said:
Try to figure out what’s different. So why isn’t dirbuster working for you when a browser is.Yeah I understood that, but don’t know how to enumerate
I was able to do what I needed with Zap and some creativity to bypass this.
can someone msg me in private a hint about how to enter what I need on the right place… I know the vector and what nees to be done but can’t modify the payload in a way to get what I need for admin.
Same here… a simple payload works, but I can’t get to the sid information I need. It’s so frustrating. I’ve been going over every avenue I can think of. A nudge into the right direction would be appreciated (pm).