Walkthrough - OWASP Top 10 - TryHackMe
Tags: cybersecurity, tryhackme, owasptop10
Published: 2020-07-17 18:17:30

Hi Guys!
This is my very first Walkthrough/Write-Up.
This is a Walkthrough on the [OWASP Top 10 room](https://tryhackme.com/room/owasptop10) in [TryHackMe](https://tryhackme.com/).
This is a beginner room - as in 
>The challenges are designed for beginners and assume no previous knowledge of security.

---
<a name="top"></a>
I am going to walk you through the steps I followed to find the answers.
- [Day 1 Injection](#day-1-injection)
  1. [Strange Text](#strange-text)
  2. [Number Of Users](#number-of-users)
  3. [User](#user)
  4. [User shell as](#user-shell-as)
  5. [Ubuntu Version](#ubuntu-version)
  6. [MOTD](#motd)
- [Day 2 Broken Authentication](#day-2-broken-authentication)
  1. [Darren's Account](#darren's-account)
  2. [Arthur's Account](#arthur's-account)
- [Day 3 Sensitive Data Exposure](#day-3-sensitive-data-exposure)
  1. [Sensitive Directory](#sensitive-directory)
  2. [DB File](#db-file)
  3. [Sensitive Data](#sensitive-data)
  4. [Admin Password](#admin-password)
  5. [Admin Flag](#admin-flag)


### Day 1 Injection
#### Strange Text:
A strange text file in the website root directory:
    I used `ls`. We see the output something like this:
    ![lsOutput](https://dev-to-uploads.s3.amazonaws.com/i/kyapd3z1xjoaxg5s0c5o.png)
    `ls` command lists all the available files and folders in the current directory. And with that output, we understand that `drpepper.txt` is a strange text file.
[Take me to Top](#top)
#### Number Of Users
The number of non-root/non-service/non-daemon users:
    We can use the command: `cat /etc/passwd | cut -d: -f1`
    I found this command here: [LinuxHandBook](https://linuxhandbook.com/linux-list-users/)
    ![UserList](https://dev-to-uploads.s3.amazonaws.com/i/6e4rvsj1swapyz5lhjyk.PNG)
    And the output from the command shows there are no users that are non-root/non-service/non-daemon. And therefore the number is 0. The `cat` command prints all the contents of a file mentioned and we are using pipe - `|` to send the output of the cat to the following command i.e, `cut -d: -f1` which cuts(or only prints) a repeating part of an output. In our case - we mention the delimiter as `:` and the `-f1` would print the first part of the delimited string.
[Take me to Top](#top)
#### User:
The user of the app:
    ![user](https://dev-to-uploads.s3.amazonaws.com/i/wwpdj9sb8s5twhnfhzha.PNG)
    `whoami` is a command that shows the current user of the application through which the shell/bash is running. So the user is `www-data`
[Take me to Top](#top)
#### User Shell As:

I used `id` to find the user id. Which is 33. `id` prints the current user-id and group-id.

![UserId](https://dev-to-uploads.s3.amazonaws.com/i/lemp2g2isnhy8ifuem3o.PNG)

And then I used `cat /etc/passwd/` to print all the list of user information.

![passwd](https://dev-to-uploads.s3.amazonaws.com/i/ckkwaa0dqh7bgvdo0fba.PNG)
     With the command, we see a lot of information here, and we need to find the one with the id 33, or the one with the user as `www-data` as we found in question 3. And we see that the user is set as `/usr/sbin/nologin`.
[Take me to Top](#top)
#### Ubuntu Version
The version of Ubuntu:
    I found this command `cat /etc/os-release`, can print comprehensive information on the Operating System. 
    ![OS](https://dev-to-uploads.s3.amazonaws.com/i/6el8shm1xtoo67yttujs.PNG)
    Here we see the version as `18.04.4`.
[Take me to Top](#top)

#### MOTD:

I first could not find the motd as I first thought its at `/etc/motd`. Then I found that it's a different directory.

![motdDir](https://dev-to-uploads.s3.amazonaws.com/i/o660p8fy85nggk6a7v66.PNG)

With the command `ls /etc/update-motd.d/` I could see the files and one of them is `00-header` and this is mentioned in the hint. So I used the command `cat /etc/update-motd.d/00-header`

![motd-00-header](https://dev-to-uploads.s3.amazonaws.com/i/st8tjbat0liz4ygygdd5.PNG)
Now we can see in the last line of the output talks about "Dr Pepper" and that is the favorite beverage.

[Take me to Top](#top)

### Day 2 Broken Authentication

I found this type of attack cool. Now, if we just follow the instructions we can find the answers to the given questions.

<a name="darren's-account"></a>

#### Darren's Account:
We try to register a new account using the name "darren" but we see a message saying user already exists. But the problem with this is in the backend of the application, with this step we now have overridden the password for darren with what we have used for the registration. Now we just have to login using the same password but add a space to the username: " darren".

Now we are logged in as darren and we see the flag.

![Darren's Account](https://dev-to-uploads.s3.amazonaws.com/i/he3e6jz3u0s7t0wf7bll.PNG)

[Take me to Top](#top)

<a name="arthur's-account"></a>

#### Arthur's Account:

We follow the same steps that we followed for darren's account.
We try to register using username "arthur" and some password.
Then we see the message that user already exists.
Then we login as " arthur" and the same password we used to register. We are taken to arthur's account.

![Arthur's Account](https://dev-to-uploads.s3.amazonaws.com/i/d6gfa05hwoxk0vtjya6d.PNG)

[Take me to Top](#top)

### Day 3 Sensitive Data Exposure
#### Sensitive Directory:
For this task, I used a subdirectory enumerator software called DirBuster that is available in Kali Linux by default.

I used the following settings:

![Dirbuster Settings](https://dev-to-uploads.s3.amazonaws.com/i/tbqg9fipbf7ghu2e3yxs.PNG)

I used the wordlist file that is available by default here:
`/usr/share/dirbuster/wordlists/directory-list-2.3-medium.txt`

Then I let it run for a while and found.

![Dibuster](https://dev-to-uploads.s3.amazonaws.com/i/ztffbx4yxy5p7ko8etlm.PNG)

But it will be a lot simpler if we use the hint. We see that there is something in the login page source code.

![Login Source](https://dev-to-uploads.s3.amazonaws.com/i/c1knubdinxs5buksz48j.PNG)

We see that the developer has stored something in the `/assets` directory.

[Take me to Top](#top)

#### DB File:

When you open the directory you will see the `.db` file. Click on it to download. 

![Assets](https://dev-to-uploads.s3.amazonaws.com/i/75jadsymfrtumjzz6a60.PNG)

Or you could directly go to ` http://MACHINE_IP/assets/webapp.db` to download.

![Webapp](https://dev-to-uploads.s3.amazonaws.com/i/u0shejhr93i6th30njhc.PNG)

[Take me to Top](#top)

#### Sensitive Data:

Then I used the mentioned commands in the given Material. And found the following:

![db data](https://dev-to-uploads.s3.amazonaws.com/i/g8j68olz1urhdqyknp34.PNG)

We see the Admin, Bob, Alice users and their password hash.

#### Admin Password:

I used the website [Crackstation](https://crackstation.net/) mentioned in the given material to crack the password hash.

![Admin Password](https://dev-to-uploads.s3.amazonaws.com/i/od3t8kme01rydigllsj0.PNG)

[Take me to Top](#top)

#### Admin Flag:

I used the login page to login as admin and found the flag.

![Admin Flag](https://dev-to-uploads.s3.amazonaws.com/i/dn691cnjjefe7x56zgz6.PNG)

[Take me to Top](#top)

The current room is a progressive room and releases one task per day. I will try to update this page as and when I find the answers.