# Intro to Web

## Challenge

> It's nice to have some training problems.
>
> <https://bluehens-webstuff.chals.io/>

## Solution

When checking the link, we end up on a blank page with some text.

<figure><img src="https://1102212211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fa46Jmz9dIuFnWcXn3ooO%2Fuploads%2F2C6ApdgzF05y0eqys97j%2Fwebpage.PNG?alt=media&#x26;token=f2ab3f27-03d9-4400-b3e0-914006936c47" alt=""><figcaption></figcaption></figure>

Now, "version control" naturally makes me think of git. So let's check if we can find something...

So `/.git/` is forbidden but when we keep looking, there's the HEAD file which contains interesting information.

<figure><img src="https://1102212211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fa46Jmz9dIuFnWcXn3ooO%2Fuploads%2FIV6pasjHgVTEHJknCf0j%2Fgit_ref.PNG?alt=media&#x26;token=99640276-e660-4425-916a-54d85769e4e2" alt=""><figcaption></figcaption></figure>

So of course, I went to see the contents of that ref.

<figure><img src="https://1102212211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fa46Jmz9dIuFnWcXn3ooO%2Fuploads%2FsfxwvjnELzBfEJbuIzNy%2Fcommit_id.PNG?alt=media&#x26;token=ff5c9380-e307-400a-beee-567f2f20c79f" alt=""><figcaption></figcaption></figure>

This number is actually the commit id for the latest commit in the master branch.

But to go further with this, we first need to download the git repository somehow. After some digging I found the Dumper tool from [GitTools](https://github.com/internetwache/GitTools) and it works like a charm.

<figure><img src="https://1102212211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fa46Jmz9dIuFnWcXn3ooO%2Fuploads%2FoYBkxfgEqGw89wgKMWKa%2Fgit_dumper.PNG?alt=media&#x26;token=f8542af3-d20f-417e-b975-a2025a7e0d91" alt=""><figcaption></figcaption></figure>

Now we've got a load of files but no way to read them. So we use the Extractor from the earlier mentioned GitTools.

<figure><img src="https://1102212211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fa46Jmz9dIuFnWcXn3ooO%2Fuploads%2F5tTZlqai2CxuWduqUkHo%2Fgit_extractor.PNG?alt=media&#x26;token=8309b478-f55a-4b78-a25e-3be388091e9b" alt=""><figcaption></figcaption></figure>

As we know, the `6d11ca62644930fee1e2e48345c8d35bde2a95e7` file refers to the last commit, which is not what we're interested in. Let's look at the other one. It contains 2 files: `commit-meta.txt` and `index.html`.

This is what the text file contains:

<figure><img src="https://1102212211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fa46Jmz9dIuFnWcXn3ooO%2Fuploads%2FWNf8oEGvVkp4zYrkQbGc%2Fcommit-meta.PNG?alt=media&#x26;token=259bbf70-ab47-4074-967e-5ca02438650f" alt=""><figcaption></figcaption></figure>

And the web page looks like this:

<figure><img src="https://1102212211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fa46Jmz9dIuFnWcXn3ooO%2Fuploads%2FruP3Fs83WOLjIBqDvBn0%2Fwebpage_login.PNG?alt=media&#x26;token=595cc005-25d1-4ea6-948e-5f0d0bb19fc3" alt=""><figcaption></figcaption></figure>

Let's check out the code of this web page.

<figure><img src="https://1102212211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fa46Jmz9dIuFnWcXn3ooO%2Fuploads%2FM6yUQTkG4vFvyDkBp0Fs%2Fcode_indexhtml.PNG?alt=media&#x26;token=605a9904-478d-47ae-9bfc-6ffc894f03e0" alt=""><figcaption></figcaption></figure>

We can see there's a password stored and it's hashed using the MD5 algorithm. Using an [online MD5 decrypter](https://10015.io/tools/md5-encrypt-decrypt) I managed to find the password.

<figure><img src="https://1102212211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fa46Jmz9dIuFnWcXn3ooO%2Fuploads%2FO42JqgAUdw9YLWVsgxWH%2Fmd5_decrypt.PNG?alt=media&#x26;token=851832e7-0a06-4df8-bf33-c12f4196197a" alt=""><figcaption></figcaption></figure>

Now, let's enter it on our page.

<figure><img src="https://1102212211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fa46Jmz9dIuFnWcXn3ooO%2Fuploads%2F0EFu8PKOVT6oXEn9IsEm%2Ffetchingflag.PNG?alt=media&#x26;token=94d47425-cb43-4527-bb44-6f65e7647a80" alt=""><figcaption></figcaption></figure>

It works ! But wait, where's my flag ? Oh right, we don't have access to it on this page. When checking the DevTools we can indeed see it tried to request the flag, but got an error.

<figure><img src="https://1102212211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fa46Jmz9dIuFnWcXn3ooO%2Fuploads%2FyVlaSsYsWK8SEPsWhZxH%2Fdevtools.PNG?alt=media&#x26;token=76ac11c5-5245-43df-8820-d14e18895ac4" alt=""><figcaption></figcaption></figure>

What if we copied those parameters and used it on the actual website ?

<figure><img src="https://1102212211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fa46Jmz9dIuFnWcXn3ooO%2Fuploads%2FtUvBP8uUVWUjJz9sWxwj%2Fbingo.PNG?alt=media&#x26;token=9510edd8-d83b-42cb-9268-62175f2bdb11" alt=""><figcaption></figcaption></figure>

Bingo !
