Human Connection Challenge: Season 1 – Web Exploitation

In this walkthrough, I'll share some strategies for efficiently completing the lab, based on my perspective as the author. Remember, there are often multiple ways to approach a challenge, so if you used a different method and succeeded, that's perfectly fine! The goal is to learn, and I hope these notes help clarify any steps and reinforce key concepts for the next challenge.

This challenge has now ended, but the lab remains available for practice. While prizes are no longer up for grabs, you can still complete the lab and use this walkthrough guide for support if needed. 

I’ve also used placeholders in some of the commands that would give away an answer directly, so if you see anything enclosed in angle brackets, such as <username>, please make sure you replace it with the actual value, such as user1.

With all that considered, let's get started.

Overview

Task: Using the Firefox browser, navigate to The Happy Teeth Company web application, found at http://the-happy-teeth-company.bitnet.

Task: Identify a directory on the web application that's disallowed to web crawlers.

1. What is the name of the directory?

On the Kali desktop, open the Firefox application and enter http://the-happy-teeth-company.bitnet into the browser to navigate to the Happy Teeth Company website.

The key phrase in this task is “web crawlers”, which are also referred to as robots. The robots.txt page defines areas that shouldn’t be accessed by web crawlers, and reveals areas that aren’t intended for normal users to access, making it a simple but effective tool for directory discovery. 

To find what directory is disallowed to web crawlers, add /robots.txt to the end of the website URL:

http://the-happy-teeth-company.bitnet/robots.txt

You’ll find the directory name on this page.

Task: Identify a login page that's not directly accessible from the web application's main site.

2. What is the path of the page?

To find the login page, you’ll need to open Terminal on the Kali Desktop. Then, you’ll need to use the Dirbuster tool with a wordlist to brute force any hidden pages that aren’t listed or linked from the main site.

Wordlists for dirb (the command line version of Dirbuster) can be found in the /usr/share/dirb/wordlists directory on the Kali desktop. The syntax for the dirb command is:

dirb http://the-happy-teeth-company.bitnet /usr/share/dirb/wordlists/small.txt

This command will return a single directory. You’ll then be able to navigate to this URL and find a login page. 

Identify a username that's been mistakenly left on the web application.

3. What is the username?

For this question, you’ll need to navigate to the website’s main homepage, then right-click and select View Page Source. From here, scroll down the page until you see a comment that’s highlighted in red text that contains the username:

<!---- [Comment] -->

Task: Use a password cracking tool with the wordlist /usr/share/wordlists/metasploit/burnett_top_1024.txt to find the password for the user.

4. What is the user's password?

You can crack the user’s password using the Hydra tool and some specified options. Together, the command run in the Terminal should look something like this:

hydra -l <username> -P /usr/share/wordlists/metasploit/burnett_top_1024.txt the-happy-teeth-company.bitnet -f http-post-form "/<login-page>:username=^USER^&password=^PASS^:F=invalid"

This command first specifies the login name as the found username (-l <username>), the wordlist (-P /usr/share/wordlists/metasploit/burnett_top_1024.txt), the target (the-happy-teeth-company.bitnet), to quit when it finds one valid password combination (-f), and that the target page is an HTTP POST form.

Next, it tells Hydra that the login page to attempt the credentials on (the previously found login page) and the form data sent will replace ^USER^ with the username and ^PASS^ with a password from the wordlist. If the server replies containing the word invalid, this means the login attempt failed. 

When you run this command, Hydra will attempt to log in to the page using the username and each password in the wordlist. If you want to view this process in real time with each password being attempted, you can also add the -V parameter to the end of the command for the verbose output.

Hydra will successfully crack the user’s password a minute or so after running the command.

Task: Log in to the previously found login page with these credentials.

5. What is the token on the dashboard?

Navigate to the previously found login page and enter the username and cracked password. Click Login, and the new page will reveal a token.

Task: Identify a SQL injection vulnerability on the web application that reveals stored usernames and passwords in the error message.

6. What is the username beginning with M?

On the top-right of the homepage, you’ll find a link to the Members Login page. If you attempt to log in with a random username and password, an error message will display, stating that the user isn’t found.

To find what else this error message could inadvertently display, you can inject an always true SQL query into the Username field:

'or'1'='1

Since '1'='1 is always true, the error message will return all rows from the queried SQL table if the field is vulnerable.

After entering the SQL query, enter any password and click Login. When the page reloads, usernames will be displayed in the error message, and one will begin with M.

7. What’s the user's password?

Now you know that the Username field is vulnerable to SQL injection, you can manipulate the query to return other information from the database.

Using the username you found beginning with M, you can change the SQL query to:

' or username='<username>

Because you know an existing username, this condition will return as true. After entering a password and clicking Login the user’s password will display in the error message.

Task: Identify a reflected XSS vulnerability on the web application that reveals a token in the error message.

8. What is the token?

At the top of the homepage, click on the Join Us Today button or scroll down until you get to the section on Practice Membership and Treatments and click Enquire Today. Both of these buttons will direct you to a registration page.

This page contains a number of fields on a form, including name, email address, and street address. From the task, you know you’re looking for a reflected XSS vulnerability, so you can enter the following payload into the fields to test for XSS:

<script>alert("xss")</script>

Navigate through each field and test the payload by clicking Register Now until you find that the Phone Number field is vulnerable and reflects the “xss” message. Once you see this, click OK to close the window and find the token in the error message underneath the Register Now button.

Task: Identify a file inclusion vulnerability on the web application.

Task: Use directory traversal techniques to read the file token.txt.

9. What’s the token?

Navigate back to the main homepage and scroll down until you find the newsletter section. Underneath the Subscribe Now button, you’ll find a link to View Our Most Recent Newsletter, which you can click.

You’ll now be shown a newsletter PDF file which appears in the URL as:

http://the-happy-teeth-company.bitnet/view?file=newsletter.pdf

This indicates that the application could be dynamically loading the file in the URL “file” parameter. To test this, you can manipulate this parameter to see if it’s vulnerable to a local file inclusion (LFI) exploit and will load other files – such as token.txt.

In the URL, change the “file” parameter to:

http://the-happy-teeth-company.bitnet/view?file=../../token.txt

Press Enter, and a new page will load with a token.

Tools

This challenge primarily relies on your skills in web application exploitation and only requires two tools: Dirbuster for directory enumeration and Hydra for password cracking.

Tips

When testing for web application vulnerabilities, remember that vulnerabilities may reside in any part of the application. Subtle elements that appear unimportant could prove exploitable if they neglect to handle inputs securely. So make sure you check all user input forms and any buttons or links that direct you to different parts of the application. 

If you want to learn more about some of the tools within this lab, take a look at the following lab collections:

• Secure Testing – Beginner
• Credential Access
• SQL Injection Basics
• Cross-Site Scripting (XSS)

Conclusion

The steps I’ve laid out here aren’t the only way to find the answers to the questions. As long as you find the answers, you did it – well done!

If you think there’s a better method to find some of the answers than what I’ve described above, please post it in the comments below!

I hope you enjoyed the challenge and I’ll see you for the next one!