about me
Hi im Arnold Prakash,im a noobie in this field the workshop was a great help for me ,please forgive my mistakes.This is my firstever write up in my life. and im using github also for the first time even though i had an account.
writeup
First lets update the docker. use this command
wget https://websploit.org/update.sh
and
bash update.sh
![Screenshot (3803)](https://user-images.githubusercontent.com/64747552/97775602-0054ed00-1b88-11eb-997b-ad5c98393735.png)
sorry for the long screenshot i didn't get time to edit it.
now lets have fun
'docker ps' to see the status
![Screenshot (3808)](https://user-images.githubusercontent.com/64747552/97775776-4a8a9e00-1b89-11eb-8f10-1e8409511527.png)
when everything is going right go to your browser and type
http://127.0.0.1:9002
![Screenshot (3810)](https://user-images.githubusercontent.com/64747552/97776080-727b0100-1b8b-11eb-8308-c85a3dd5a92c.png)
the web app is ready to get abused.
while surfing through the page i saw an hash below the google maps.
![Screenshot (3811)](https://user-images.githubusercontent.com/64747552/97776279-cafece00-1b8c-11eb-9fcc-613f814b9b5e.png)
this is a base 64 hash so lets decode it with an online decoder
![Screenshot (3812)](https://user-images.githubusercontent.com/64747552/97776297-e79b0600-1b8c-11eb-9b2c-017f5edae46b.png)
may be this is a clue.. we should check all the directories now.
lets see....
wait what am i seeing here
![Screenshot (3813)](https://user-images.githubusercontent.com/64747552/97776613-950f1900-1b8f-11eb-9611-15119bd39d4d.png)
![Screenshot (3814)](https://user-images.githubusercontent.com/64747552/97776616-9ccebd80-1b8f-11eb-9e02-7ced59998597.png)
is this the flag ..?
not sure im just a curious beginer. hahaha.
let's analysze this hash using any online hash analyzer.
![Screenshot (3817)](https://user-images.githubusercontent.com/64747552/97776646-e28b8600-1b8f-11eb-8b05-b88c20557f11.png)
its a SHA2-256 type of hash.
lets try to decode it.
i cross cheched with built-in tool of kali
![Screenshot (3818)](https://user-images.githubusercontent.com/64747552/97776774-1d41ee00-1b91-11eb-9619-31df50accdc5.png)
sudo hash-decoder
just paste the hash there
![Screenshot (3820)](https://user-images.githubusercontent.com/64747552/97776789-3d71ad00-1b91-11eb-8bab-b506e52b4496.png)
seeing this you might feel like how can some one be so nooobbbieee hahaha i am :)
im just adding screenshot of the agrassive scan done to the ip also,i have no reason for it, i just felt like doing it.
![Screenshot (3822)](https://user-images.githubusercontent.com/64747552/97777515-c8a17180-1b96-11eb-88ce-8780e3470ec8.png)
flag: f15f48da327e692e8f36e583426b95edc9838bbf1382508f0044a18df59e5ddd
since there i couldnt find no other place do any xss or sql injection type acctacks im wraping up here.
thank you for reading. Happy hacking. Peace out.
contact : [email protected]
while i scaned with a tool called nikto i could find more about the server and version and its vulnerabilities.
![Screenshot (2)](https://user-images.githubusercontent.com/64747552/97798914-7e7cc680-1c50-11eb-8963-5fd6188cef71.png)