CyberHeroes | TryHackMe | WriteUp | MZS

Hello everyone, I hope you are doing well. This room is about authentication bypass vulnerability on TryHackMe.

I will go through the simple steps. First, we will look at the web page.

As we can see we have a login page, let’s visit it.

Here we can start with username enumeration using ffuf - Fuzz Faster U Fool. What is FFUF?
ffuf is a fest web fuzzer written in Go that allows typical directory discovery, virtual host discovery (without DNS records) and GET and POST parameter fuzzing. ffuf | Kali Linux Tools

But first and foremost let us check its page source for any possible additive information during our recon phase.

Look what we have found…! When we look at the script behind the authentication process of this web application, we have found out user name and reserve string of passwords. Lets perform reversing string of the password using online tool at Code Beautify.

Now use this user name and password to login into the web application and capture the flag.