# Web Hacking: OWASP Top 10 - 2021 (TryHackMe)

In this article, I will write a write-up for OWASP Top 10 - 2021 that covers Broken Access Control, IDOR Challenge, Cryptographic Failures with Support Materials and Challenges, Injection, Command Injection, Insecure Design, Secure Misconfiguration, Vulnerable and Outdated Components, Identification and Authentication Failures, Sofware and Data Integrity Failures, Security Logging and Monitoring Failures, and Server-Side Request Forgery(SSRF).

1. Deploy the machine and go to [http://](http://machine_ip/)MACHINE\_IP - Login with the username noot and the password test1234. Look at other users' notes. What is the flag? `flag{fivefourthree}`
    

there’s a hint that the id can be lower than if you put the id to be 0 you get the flag we’re looking for also note the note.php on the path

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1730519378719/80336765-c6ba-41d3-bea0-76a63b3a5d0b.png align="center")

2. Have a look around the web app. The developer has left themselves a note indicating that there is sensitive data in a specific directory. What is the name of the mentioned directory? `/assets`
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1730519349764/036fe9d5-39ad-4fa5-bb9f-2d76afd7b291.png align="center")
    
3. Navigate to the directory you found in question one. What file stands out as being likely to contain sensitive data? `webapp.db`
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1730519328009/668c6e89-71b9-4c3f-b121-cbc176f55d8c.png align="center")
    
4. Use the supporting material to access the sensitive data. What is the password hash of the admin user? `6eea9b7ef19179a06954edd0f6c05ceb`
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1730519296301/00e57532-115c-4f5e-9901-e3dd4707ed4f.png align="center")
    
5. Crack the hash. What is the admin's plaintext password? `qwertyuiop`
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1730519277449/aba3fb12-37c7-4555-855a-bef78ad2a10b.png align="center")
    
6. Log in as the admin. What is the flag? `THM{Yzc2YjdkMjE5N2VjMzNhOTE3NjdiMjdl}`
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1730519259258/73e5a3a2-b8ef-48eb-ac68-d76b6acf288b.png align="center")
    
7. What strange text file is in the website's root directory? `drpepper.txt`
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1730519238512/6e159fd9-0a61-47db-8337-d7d31ab0deff.png align="center")
    
8. How many non-root/non-service/non-daemon users are there? `0`
    
9. What user is this app running as? `apache`
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1730519212932/adf78ca4-505d-43f5-b193-6d9b40a7906b.png align="center")
    
10. What is the user's shell set as? `/sbin/nologin`
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1730519195308/abdb6a07-920d-4107-b806-4dce4eed291e.png align="center")
    
11. What version of Alpine Linux is running? `3.16.0`
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1730519176074/9c946f88-f70c-4466-8f5c-665e47949558.png align="center")
    
12. Try to reset joseph's password. Keep in mind the method used by the site to validate if you are indeed joseph.
    
    when trying to reset joseph’s password, I opted for the favorite color and green was correct
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1730519103950/1442fdaa-add7-4c29-b877-4071d53e1d00.png align="center")
    
13. What is the value of the flag in joseph's account? `THM{Not_3ven_c4tz_c0uld_sav3_U!}`
    
    Navigate to [http://MACHINE\_IP:86/console](http://machine_ip:86/console) to access the Werkzeug console.
    
14. Use the Werkzeug console to run the following Python code to execute the `ls -l` command on the server:
    
    ```python
    import os; print(os.popen("ls -l").read())
    ```
    
15. What is the database file name (the one with the .db extension) in the current directory? `todo.db`
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1730519045260/d1d48fbc-83fa-4004-8279-4a3b95fa8284.png align="center")
    
16. Modify the code to read the contents of the `app.py` file, which contains the application's source code. What is the value of the `secret_flag` variable in the source code? `THM{Just_a_tiny_misconfiguration}`
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1730519006001/aeb9fcbe-5aa0-4533-a624-1c8f506222a7.png align="center")
    
    Navigate to [http://MACHINE\_IP:84](http://machine_ip:84/) where you'll find a vulnerable application. All the information you need to exploit it can be found online.
    
    Answer the questions below
    
17. What is the content of the /opt/flag.txt file? `THM{But_1ts_n0t_my_f4ult!}`
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1730518972881/d45c7b4d-6cb5-4308-8ce2-4e3a619c9075.png align="center")
    

To see this in action, go to [http://MACHINE\_IP:8088](http://machine_ip:8088/) and try to register with `darren` as your username. You'll see that the user already exists, so try to register " darren" instead, and you'll see that you are now logged in and can see the content present only in darren's account, which in our case, is the flag that you need to retrieve.

19\. What is the flag that you found in darren's account? `fe86079416a21a3c99937fea8874b667`

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1730518934285/cff05967-b1a6-43ab-9aa5-aa5421662ad7.png align="center")

20\. Now try to do the same trick and see if you can log in as arthur.

21\. What is the flag that you found in arthur's account? `d9ac0f7db4fda460ac3edeb75d75e16e`

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1730518885087/48ced80f-c262-40ad-b8fe-4ac03b531ff3.png align="center")

22. What is the SHA-256 hash of `https://code.jquery.com/jquery-1.12.4.min.js`? `sha256-ZosEbRLbNQzLpnKIkEdrPv7lOy9C27hHQ+Xp8a4MxAQ=`
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1730518858558/8be13ef8-af73-461b-8b5f-40fbe126e55c.png align="center")
    

It sounds pretty simple! Let's walk through the process an attacker would have to follow in an example scenario. Navigate to [http://MACHINE\_IP:8089/](http://machine_ip:8089/) and follow the instructions in the questions below.

23\. Try logging into the application as guest. What is guest's account password? `guest`

The login error message has the guest’s password

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1730518800189/b04df8bc-93c2-4390-94c4-030797eae5bf.png align="center")

24\. What is the name of the website's cookie containing a JWT token? `jwt-session`

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1730518765111/cbcb8cad-71d7-43dd-b539-aedcb2dad288.png align="center")

25\. Use the knowledge gained in this task to modify the JWT token so that the application thinks you are the user "admin".

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1730518741466/754e2ade-9b9e-4275-89e7-371ca7a8c8e2.png align="center")

26\. What is the flag presented to the admin user? `THM{Dont_take_cookies_from_strangers}`

27\. What IP address is the attacker using? `49.99.13.16`

28\. What kind of attack is being carried out? `Brute Force`

Navigate to [http://MACHINE\_IP:8087/](http://machine_ip:8087/), where you'll find a simple web application. After exploring a bit, you should see an admin area, which will be our main objective. Follow the instructions on the following questions to gain access to the website's restricted area!

29\. Explore the website. What is the only host allowed to access the admin area? `localhost`

30\. Check the "Download Resume" button. Where does the server parameter point to? [`secure-file-storage.com`](http://secure-file-storage.com/)

31\. Using SSRF, make the application send the request to your AttackBox instead of the secure file storage. Are there any API keys in the intercepted request? `THM{Hello_Im_just_an_API_key}`

Here are some resources that were helpful in addressing some questions or when stuck: [Medium blog](https://medium.com/@debrikchakraborty200/owasp-top-10-2021-f06f7c5f4f84), [Base64 Encoder Decoder](https://appdevtools.com/base64-encoder-decoder), and [Online Book Store 1.0 - Unauthenticated Remote Code Execution](https://www.exploit-db.com/exploits/47887) exploit.

Thank you for reading my article. Please leave any questions or comments on improving my learning journey and the THM challenges.