Hi, within this lecture, we're going to continue solving our CTF and we're going to consider following
our leads over here.
So I'm going to just stop this nearby, sir, because again, we have what we need.
Like, we know that there is a work press over here and we're going to follow that road.
And over here, the Nito didn't even complete the scan over there.
So we have a lot of things going on over here.
So NICTA can take long, actually.
Just bear in mind that sneak can take long.
So maybe this can be your first step.
Just run it in the background and just come back and see what happens later.
And as you can see, we started getting some responses over here, but it's going to take long.
And again, we have an admin folder over there, I believe.
So let me try to go into the admin.
So it's it actually isn't supposed to be here, right?
Because it isn't the regular standard procedure for the WordPress.
It's usually WP admin or WP log in.
And again, I believe it redirects us to indexer BHP.
So I don't know.
There is nothing to pursue in the admin folder, I believe.
So again, let me try this one.
So as you can see, there is a page parameter over here.
Maybe we can change it or maybe we can try something like directory traversal like we have found before.
So I'm going to come over here, not here, but there.
And I'm going to just write Questionmark, page 23 and here you go.
So it just redirects us to index as well.
So nothing happens with page parameter, but maybe we can just try page one or page zero or maybe we
can just try directory traversal, as I said before, like this that dot slash atse password and see
what happens.
Nothing is happening.
And in fact I believe none of this is working because it's all redirecting us to the original index
page.
So I believe it's better to follow the WP login or W or WordPress in general.
OK, so over here we have the short list we already took, taking a look at that.
So we plug in yet we we're definitely going to take a look at that, this one.
OK, and we have seen that over here as well.
And I believe we don't have WP admin this time.
We have WP login.
So far, so good.
And we can just skip over here a little bit and see if we can find anything interesting, much more
interesting over here.
But I don't think there there is.
Right.
So we get have to focus on the WP log in and I believe we haven't checked the robots tactics as well.
So I'm going to take a look at that as well later on.
So I'm going to come over here, OK, and delete this and come to we plug in and here you go.
This is the login web page of the IRC press, and I'm going to go for the Channel 215 one more time,
this time for weepie admin.
Yep.
They are redirecting us to the same page.
As you can see, it's redirecting us to the WP login.
So this is definitely going to be a WP login thingy going on over there.
So we have the WordPress admin login and some other stuff going on over here, but they are all related
with the WP login, I believe.
OK, so let me see what what this is we have license to see, which won't give us anything I believe,
but it's worth a shot anyway.
So let me see if we have anything else.
NUPE, let me come over here and just search for this one as well.
So license that to let me delete the extra slash and here you go.
This is just the license of the WordPress, I believe.
So let me just go back and better yet, we can just go for the robots, that THC, which is the first
thing that we should have been looking for anyway.
As you can see, there are a couple of things over here.
We have a society, dick and key, one of three to see.
So we have.
The first flag, I believe he was one of three texte, so I can get that easily from the URL and we
have an F Society dictionary over here.
So this makes me think that this is going to be a brute force thing.
And also, if you don't know about 60, by the way, if you don't know whether this this is a system
in order to say the crawlers of the websites like Google just don't look over here, OK?
So don't look over key one, two, three, texte.
And Google doesn't get that and doesn't index that we did scroller.
But again, as Hecker's, we should look there first in order to see what's this allowed for the Google.
So I'm going to come over here to my nose, start to extend just space, the section over there.
This is our first flag, OK?
It was pretty easy to get that.
But again, I believe rather than flag, we should focus on the Z Society Dictionary over here.
So I'm going to copy this and try to see what's inside of this dictionary and let me just save the file.
It says that this is C source code, but I don't think that's what this.
OK, so I'm just going to save this file and see the content of it.
So if this is a dictionary, as we presume, then I believe we're going to have to do some kind of brute
force thing.
So I'm going to cut this and put this in my CTM folder on there, Mr. Robot, and pasted over there
and just open it with any text editor like this.
And here you go.
There are a couple of words over here, like maybe hundreds or thousands of words.
And they they should be some kind of password or username or both, we don't know yet.
OK, so you can just take a look at all of those things and try to find some meaningful things.
But again, there are a lot over here, so we cannot try them one by one.
We have some kind of like generic ones like file in type.
We have some kind of duplications, I believe, and we have a lot over here.
Right.
So it's going to take some time and maybe we can just take the unique values like we have seen in the
Bendit to get rid of the duplicates over here.
Like if we search for your UL, we have Bazra.
Let's see if we have another Eurail over here like we have.
Jodrell, edit the URL.
Yeah, we have another Eurorail over here, which is only in case we have another basic URL.
I believe.
So definitely there are some duplicates and these are not alphabetically ordered.
So it's going to be kind of challenging over here.
Right.
So I'm going to come over here and clear this up.
So if you're on an SLA now, we know if societys over a year and it's seven meg and it's very big.
So we have a lot of things going on over there.
So it's going to take some time.
And most probably we're going to have to brute force here so that we can just log in as a user.
And we don't know if if they are here for user name or they are here for a password and we don't know
if they are here for both.
If we are given a dictionary, I believe most probably they're here for both so we can find the user
name and we can find the password in that dictionary.
Otherwise they wouldn't give us anything.
And we can just go for the ready to use dictionaries like Rakolta Sixty or Medium Dear Busser like we
have seen before.
But this time we are given the dictionary and we are only given one.
So I assume there's going to be usernames and passwords in the same dictionary so we can use weepie
Skemp.
I mean in order to do brute force.
If you just write weepie scan Dashti shop, you can see the documentation of the PvP scan and we have
a lot of things here like enumeration would farseeing, like detection, service detection, version
detection, plugin detection.
So they're kind of it's kind of like all in one solution for the WordPress penetration test.
And of course, we were going to use it as well.
And but first, we're going to have to do it for the user name.
And I believe we're going to have to do it for the password after we find the username so that it will
make sense because we cannot find a password without a username.
So first of all, I'm just going to search to see if we have any user that is valid inside of that f
society that we got back from the about.
And if we can find the user that we're going to find the password as well.
So we can use WordPress, VP Schenn, we can use Hydra and we can use birthweight.
So I'm going to try and show all of those things to you.
OK, we're going to have to use a whip scan eventually anyway, because it's a WordPress weapon testing.
I believe the CTF is about WordPress testing.
And let me open the birthweight.
Even though we can use Hydra, we're going to have a need for the burb suite anyway because we need
to see some responses in order to use Hydra as well.
I'm going to show you what I mean.
Don't worry, since my proxy is up right now, I'm going to have to turn on my folks, your proxy,
or just do the proxy settings for the Firefox.
If you don't know how to use birthweight, please make sure check my weapon testing course or just go
for the YouTube for a quick demonstration of it.
Or you can just follow along with me.
But I'm going to turn off the folks proxy, which will connect to the burb suite in order to transfer
our requests and responses through the verb.
So it's OK burps which is a proxy eventually.
So here when we make a request or when we make sure we get a response, it will be captured in the suite
first so that we can see them or we can analyze them or even we can change them and send some kind of
different responses or requests.
So I'm going to just try with atlatl or until one, two, three, five, four, six.
OK, we don't have that kind of password or a username, but of course we get to see this.
So I'm just going to write Clocky over here and send it to the intruder.
Intruder is the brute forcing module for the burb suite.
And don't worry, we're not going to use it.
I'm just showing it to you that it's possible to do brute force with it.
OK, I'm not going to turn this into a sweet lecture course, so I'm going to clear all of these parameters.
If I add some variables over here, like to username and password in the request, I can come over here
to pay Lawder Yapp in the payloads and I can just choose a list.
And of course, we're going to have to change the attack type from here like a sniper is only for one
parameter.
If we come over here to some other attack, we can just choose a different kind of wordlist for different
kind of parameters and we can just run it and see what happens.
OK, this is cluster bombing and we can do brute forcing directly inside of it here as well.
But again, we're not going to use this for this purpose.
We have Hydra, we have WordPress log in and the of penetration testing course, but rather we're going
to focus on the privileged escalation, on gaining access side of things.
So I'm going to send this to repeater.
So repeater is important in the repeater.
Make sure you turn the intercept off.
By the way, go back to repeater.
Now, you can see this is an invalid user name.
The user doesn't even exist.
OK, so I'm going to come back to here in the repeater.
We can just do as many repeats as we want.
We can change the request and see what kind of response do we get from the server.
That is why we use a repeater.
We can do tests and see the response of the server at the right hand side.
So, for example, I can just change the login name and password from here.
And just directly he sent in order to see what kind of response do we get back from server.
It's practical.
It's easy to use.
So why do we use this?
Because I'm going to show you how to do a brute force thing with Hydra, OK?
And for the drive, we're going to supply the Safe Society as a wordlist.
And also we're going to go for the user name first, then we can go back and find the password with
without even using Hydra.
We can use some other tools as well so that we can see every one of them.
So first of all, let me just.
Stop blabbering about this and just go for Hydra and supply a user name wordlist for the password.
As you can see, if we supply an invalid user name, we can get this invalid user name error message
and this will be different.
If we can find a valid user name, it will say that the password is wrong or something like that.
In this case, I forget the error message of invalid username.
We definitely know that this is going to be like not the thing that we are looking for, right.
Because we want a valid username.
So let's start typing Hydra.
We in order to make it verbose and I shall in order to supply the list that we are going to work with.
And by the way, this should be in the same folder when you run, unless you can see the society today.
So I'm going to say, Haidara, we all associated.
OK, so we're going to use this dictionary and we're going to supply a password because we're going
to use this dictionary on the username.
OK, so for the password, I'm just going to give like tests.
You can give it anything you want because we're not looking for a password.
We're only looking for not an invalid user.
OK, so over here we have supplied the password.
We have supplied the user name, user name list, not the user name itself, because we don't know the
user name.
And of course, we going to have to supply the tunnel to fifteen, which is our URL over here.
And now this is the reason why we have brought up the website in the first place.
Anyway, as you can see, we can see the request details over here and we're going to need those things.
So as you can see, we need this thing.
We need the log p, the VP submitting you over here, because that's how Hydro will know how to send
the request back to the server.
And as you can see, we had that post thing in the burb suite.
So I'm going to make sure we write over here HTP post form.
And after that we're going to have to specify the actual request parameters like paedophilia and stuff
like that, because it's not common.
It's specific to each website.
OK, and the Hydra will not know where to send the URL request to.
So we're going to just come over here to the website itself, actually, and get the URL parameters
to write it over there.
OK, so it will start with the Web log in P and after that we're going to have a column over here and
just write the parameters like this.
So of course we don't need redirect to, but we need these ones.
So let me copy this and see if we can copy it only and pasted over here.
Yeah, here you go.
So what will happen over here is that the server understands this parameter, so it's looking for user
name as log, it's looking for password SPW d and it's looking for submitting as WP submit.
And this is different for every server, different for every Bergkamp.
OK, so at the end of it I'm going to put a column over here and just write f invalid user name and
this is the error message that we have.
So what does it mean?
It means that if we have this invalid user name, then Hidary will know that this is a failure and instead
of giving password is one, two, three, and the user name is still re going to change this to variables
that we have supplied over here.
So rather than password, we can actually give anything to password.
It won't matter.
But you should know how it's done if if the case is a device.
So just delete the article and write with this kind of syntax over here.
User and for the password again, just delete it and as the same way just write pass so user and pass.
So user will be replaced by this and password y b will be replaced by this.
So password will be test in every request.
So it won't make sense.
But again, the reason that we are doing this is because of the need for the user name itself.
So we're going to try every possible F society to get alternative over here to find the user that works.
So if we can find the user.
We can just brute force the password and I believe just control C in order to make the stop.
I believe we have found it.
Here you go.
It shows the valid one in blue.
So how does it understand it's valid?
Because we have given the error message to the sweet, not the purpose.
We took it from the euro, but we supplied it in the Hydra.
And as you can see, this one didn't get that.
And it's written in blue.
And apparently the log in is Elliot and it shows password this test.
But of course, it's not test.
OK, I chose it in green because we have supplied error message as invalid username and then we give
the Elliot as username.
We should get something else.
Let me try this and just write it.
And here you go.
It says that the password you entered for the username Aleut is incorrect.
So Hydra did this job right.
It found one that is working and we have now a user name.
We don't know if this is a privileged user or just a regular user.
Maybe if this doesn't work, we can just go scanning the further and we can wait a little bit more in
order to see if there is some other users here in this list as well.
But at least for right now, we have one user and we're just going to go for it.
So I'm going to open my notes and just write Elliott over here and in order to take a note.
So let's stop here and continue within the next lecture.