Viewing Page Source with Restricted Access

Some websites may disable the right-click context menu to prevent users from viewing the page source. To view the HTML source code, press Ctrl+U (or Cmd+Option+U on Mac) directly in the browser. Developers often hide sensitive data like flags within HTML comments.

<!-- Flag: FLAG{hidden_in_comment} -->
<div>Page content...</div>

Analyzing the Robots.txt File

The robots.txt file, located in a website's root dircetory (e.g., https://example.com/robots.txt), guides web crawlers. It may unintentionally expose hidden directories or files that contain sensitive information.

Example robots.txt content:

User-agent: *
Disallow: /secret-path/

Visiting the disallowed path (/secret-path/) might reveal a flag or other restricted data.

Identifying and Accessing Backup Files

Developers soemtimes leave backup files with common extensions like .bak, .swp, or .~. These files can be accessed directly if not properly secured.

Example:

• Original file: index.php
• Backup file: index.php.bak

A direct request to https://target.com/index.php.bak might download the backup file, potentially revealing source code containing a flag.

Extracting Data from Browser Cookies

Cookies store session data in the browser. Use the browser's Developer Tools (F12) to inspect the Application or Storage tab and view current cookies for the site.

Example Cookie:

• Name: hint
• Value: look_in_cookie.php

This suggests visiting cookie.php on the site to find the flag.

Manipulating Disabled HTML Form Elements

Form buttons or inputs may be disabled using the disabled HTML attribute, preventing user interaction. You can remove this attribute via Developer Tools to enable the element.

HTML before:

<button type="submit" disabled="">Submit</button>

HTML after editing:

<button type="submit">Submit</button>

Bypassing Weak Authentication

Sites with simple or default credentials are vulnerable. Common default pairs include admin:admin or admin:password. Automated tools like Burp Suite's Intruder can brute-force weak passwords.

Exploiting PHP Type Juggling Vulnerabilities

PHP's loose type comparison can lead to unexpected behavior.

<?php
$value_a = $_REQUEST['param_a'];
$value_b = $_REQUEST['param_b'];

if($value_a == 0 && $value_a) {
    echo $first_flag;
}
if(is_numeric($value_b)) {
    exit();
}
if($value_b > 1000) {
    echo $second_flag;
}
?>

To bypass the first check, provide a string starting with '0' like a=0abc. This makes $value_a truthy and loosely equal to 0. For the second condition, a payload like b=1001xyz is non-numeric for is_numeric() but treated as integer 1001 in the > comparison.

Handling GET and POST Requests

Tools like browser add-ons or proxies (e.g., Burp Suite Repeater) allow manual crafting and sending of HTTP requests. For a POST request requiring a specific paramter:

Request Body:

secret_key=submitted_value

Spoofing HTTP Headers: X-Forwarded-For and Referer

Servers may check headers like X-Forwarded-For (client IP) or Referer (previous page). These can be faked using proxy tools or browser dev tools.

Modified Headers:

GET /target-page HTTP/1.1
Host: example.com
X-Forwarded-For: 192.168.1.100
Referer: https://www.google.com/

Interacting with Web Shells

A basic PHP web shell executes POSTed commands.

Web Shell Code:

<?php system($_POST['cmd_input']); ?>

Exploitation: Send a POST request with cmd_input parameter to execute commands on the server.

# Example command to find flag files
cmd_input=find / -type f -name "*flag*" 2>/dev/null

Command Injection via Input Fields

An input field designed for network diagnostics (e.g., ping) might be vulnerable to command injection if user input is not sanitized.

Vulnerable Input: Enter IP: 127.0.0.1

Injection Payload: 127.0.0.1; cat /home/flag.txt

This concatenates the cat command, potentially outputting the flag's contents.

Common injection operators:

• ; : Execute sequentially.
• | : Pipe output of first command to second.
• && : Execute second only if first succeeds.

Analyzing Obfuscated JavaScript for Credentials

Client-side password validation logic can be reverse-engineered.

Sample JavaScript:

function validate(pass_input){
    let correct_bytes = "65,66,67";
    let byte_array = correct_bytes.split(',');
    let result_string = "";
    for(let i=0; i<byte_array.length; i++){
        result_string += String.fromCharCode(byte_array[i]);
    }
    return result_string;
}
let secret_code = validate("\x41\x42\x43");
console.log(secret_code); // Outputs: ABC

The function validate converts a comma-separated list of decimal numbers into ASCII characters. The secret string passed to the function (e.g., hex escapes \x41) needs decoding to find the correct password. Use browser console tools or a hex/ASCII converter.