@vente said:
Maybe a different tool or script will give you a more conclusive result
I got it now. Had something to do with the command syntax.
Peace of Cake :bleep_bloop:
Spoiler Removed - Arrexel
im assuming it’s probably not running on port 80?
when you get stuck like this, try running through burp so you can see what’s happening. you can set a listener on port 80 and tell it to pass all traffic to the ip/port of the challenge. then you can direct your tool at localhost port 80, and see what’s happening.
This thread was full of spoilers. Please be more careful about what information you post about challenges/machines.
Spoiler Removed - Arrexel
@d3m0nr007 said:
Spoiler Removed - Arrexel
I struggled with that as well. Just carefully go over the Spoiler Removed - Arrexel you should get it.
Oh my god… Am i blind?? It was just over there and didn’t see it. Thanks. Just gone through the data really carefully. > @it4chi said:
@d3m0nr007 said:
I found the password but i am stuck in the second part. I am intercepting the requests and i can see the responses. i found the tag. Don’t know what to do next. Hints please…I struggled with that as well. Just carefully go over the Spoiler Removed - Arrexel you should get it.
I am a complete noob what am I missing it looks like hydra gave me the password and I type it in but its still invalid Im reading everything on every Tab but its all like reading Hieroglyphs
Can someone give a hint please. I’m using Hydra with http-post-form without ^USER^, am I on right way? And some passwords with this params response without “Invalid password!” but there still doesnt works. And I’ll already doing interception with burp, but can’t figure out something unusual, what I need to mentioned?
Hey guys, I need some hint on the part after I intercept the message with HTB… what do i do with it? can’t figure it out.
Thanks!
Spoiler Removed - Arrexel
Spoiler Removed - Arrexel
Spoiler Removed - Arrexel
@BernardoPie said:
Spoiler Removed - Arrexel
Take a look at the comment above. You are on the right path.
I’ve got a flag in the correct format HTB{string} but it is not validating. Any hints?
// edit: it actually accepted it, it’s just saying that it’s invalid.
Well that was frustrating. I was sure the flag was right, but it wouldn’t accept. Look at it from a different perspective and it all made sense.
Im still having trouble with the 2nd part, im looking at the response but I dont know what to look for.
I am stuck at the first part.
- How many passwords am I supposed (and allowed) to bruteforce?
I wrote a simple Javascript script and tried all passwords in
http://downloads.skullsecurity.org/passwords/john.txt.bz2
and
http://downloads.skullsecurity.org/passwords/500-worst-passwords.txt.bz2
HackTheBox rules state that “Any form of DoS (Denial of Service) is forbidden” so I am a bit hesitant to bruteforce the whole rockyou set. - People here write about using Hydra and Burp. Is there something special about using those programs or is it just a way not to write your own bruteforcing script?
Update: Password is found but the first questions remains for other challenges of the site: how much am I allowed to bruteforce?
Update 2: Solved but the questions remain
@nns2009 said:
I am stuck at the first part.
- How many passwords am I supposed (and allowed) to bruteforce?
I wrote a simple Javascript script and tried all passwords in
http://downloads.skullsecurity.org/passwords/john.txt.bz2
and
http://downloads.skullsecurity.org/passwords/500-worst-passwords.txt.bz2
HackTheBox rules state that “Any form of DoS (Denial of Service) is forbidden” so I am a bit hesitant to bruteforce the whole rockyou set.- People here write about using Hydra and Burp. Is there something special about using those programs or is it just a way not to write your own bruteforcing script?
Update: Password is found but the first questions remains for other challenges of the site: how much am I allowed to bruteforce?
Update 2: Solved but the questions remain
you don’t need bruteforce, try to understand how login work on this website