W1seGuy Difficulty: easy Platform: cryptography Yes, it’s me again with another crypto challenge! Have a look at the source code before moving on to Task 2. The server is listening on port 1337 via TCP. This room’s focus is cracking a weak encryption. Information gathering Getting the key Information gathering We’re provided with source code of application running on port 1337.…
The Sticker Shop Difficulty: easy Platform: web Your local sticker shop has finally developed its own webpage. They do not have too much experience regarding web development, so they decided to develop and host everything on the same computer that they use for browsing the internet and looking at customer feedback. Smart move!
Epoch Difficulty: easy Platform: linux, web Be honest, you have always wanted an online tool that could help you convert UNIX dates and timestamps! Wait… it doesn’t need to be online, you say? Are you telling me there is a command-line Linux program that can already do the same thing? Well, of course, we already knew that! Our website actually just passes your input right along to…
Billing Difficulty: easy Platform: web, linux Gain a shell, find the way and escalate your privileges! Note: Bruteforcing is out of scope for this room. Answer the questions below What is user.txt? What is root.txt? In this room I practiced exploiting CVEs and privilege escalation. Vulnerabilities explored: Command injection Sudoers misconfiguration Information gathering User flag: getting reverse…
El Bandito Difficulty: hard Platform: web El Bandito, the new identity of the infamous Jack the Exploiter, has plunged into the Web3 domain with a devious token scam. By exploiting the decentralized essence of blockchain, he crafted and circulated fraudulent tokens, deceiving investors and shaking the foundational trust of the decentralized finance DeFi ecosystem.
Include Difficulty: medium Platform: web, linux This challenge is an initial test to evaluate your capabilities in web pentesting, particularly for server-side attacks. Even if it’s not accessible from the browser, can you still find a way to capture the flags and sneak into the secret admin panel? Answer the questions below
Smol Difficulty: medium Platform: web, linux At the heart of Smol is a WordPress website, a common target due to its extensive plugin ecosystem. The machine showcases a publicly known vulnerable plugin, highlighting the risks of neglecting software updates and security patches. Enhancing the learning experience, Smol introduces a backdoored plugin, emphasizing the significance of meticulous code…
Injectics Difficulty: medium Platform: web Can you utilise your web pen-testing skills to safeguard the event from any injection attack? Answer the questions below: What is the flag value after logging into the admin panel? What is the content of the hidden text file in the flags folder? This room acts as a final challenge for the advanced injection attacks module. Vulnerabilities explored were:
Light Difficulty: easy Platform: db I am working on a database application called Light! Would you like to try it out? If so, the application is running on port 1337. You can connect to it using nc MACHINE_IP 1337 . You can use the username smokey in order to get started.
Lo-Fi Difficulty: easy Platform: web Want to hear some lo-fi beats, to relax or study to? We’ve got you covered! Check out similar content on TryHackMe: LFI Path Traversal File Inclusion Very simple room. Its description mentions local file inclusion vulnerability. Open the website at http://MACHINE_IP . There are links to other pages like this: http://MACHINE_IP/?page=relax.php