🚩
THM Walkthroughs
  • THM Walkthroughs
    • 🧑‍🏫Tutorial
  • 🟦Difficulty: Info
    • 🔌What is Networking?
    • 🔌Intro to LAN
    • 🐧Linux Fundamentals
      • 🐧Linux Fundamentals Part 1
        • Task 2 - A Bit of Background on Linux
        • Task 4 - Running Your First few Commands
        • Task 5 - Interacting With the Filesystem!
        • Task 6 - Searching for Files
        • Task 7 - An Introduction to Shell Operators
      • 🐧Linux Fundamentals Part 2
        • Task 3 - Introduction to Flags and Switches
        • Task 4 - Filesystem Interaction Continued
        • Task 5 - Permissions 101
        • Task 6 - Common Directories
      • 🐧Linux Fundamentals Part 3
        • Task 3 - Terminal Text Editors
        • Task 4 - General/Useful Utilities
        • Task 5 - Processes 101
        • Task 6 - Maintaining Your System: Automation
        • Task 8 - Maintaining Your System: Logs
    • 🪟Windows Fundamentals
      • 🪟Windows Fundamentals 1
      • 🪟Windows Fundamentals 2
      • 🪟Windows Fundamentals 3
    • 🔓Principles of Security
    • 🐍Python Basics
    • 🔍History of Malware
    • 🦹Common Attacks
    • 🖥️Security Awareness
    • ⚔️Intro to Offensive Security
    • 🦹Pentesting Fundamentals
    • 🔓CVE Walkthroughs
      • 🖥️Sudo Security Bypass: CVE-2019-14287
      • 🖥️Sudo Buffer Overflow: CVE-2019-18634
      • 🖥️Baron Samedit: CVE-2021-3156
      • 🖥️OverlayFS: CVE-2021-3493
      • 🖥️Polkit: CVE-2021-3560
      • 🖥️Pwnkit: CVE-2021-4034
      • 🪶Apache HTTP Server Path Traversal: CVE-2021-41773/42013
      • 🧻Dirty Pipe: CVE-2022-0847
      • 🟢Spring4Shell: CVE-2022-22965
    • 🟧Burp Suite
      • 🟧Burp Suite: The Basics
      • 🟧Burp Suite: Repeater
    • 🏁Challenges
      • ⤴️Bypass Disable Functions
    • 🎟️THM PROMOs
      • 🎟️Learn and win prizes [PROMO ENDED]
      • 🎟️Learn and win prizes #2 [PROMO ENDED]
  • 🟩Difficulty: Easy
    • 🚀Learning Cyber Security
    • 🔁The Hacker Methodology
    • 🔍Google Dorking
      • Task 2 - Let's Learn About Crawlers
      • Task 4 - Beepboop - Robots.txt
      • Task 5 - Sitemaps
      • Task 6 - What is Google Dorking?
    • 🐝OWASP Top 10
      • Task 5 - Command Injection Practical
      • Task 7 - Broken Authentication Practical
      • Task 11 - Sensitive Data Exposure (Challenge)
      • Task 13 - XML External Entity - eXtensible Markup Language
      • Task 14 - XML External Entity - DTD
      • Task 16 - XML External Entity - Exploiting
      • Task 18 - Broken Access Control (IDOR Challenge)
      • Task 19 - Security Misconfiguration
      • Task 20 - Cross-site Scripting
      • Task 21 - Insecure Deserialization
      • Task 24 - Insecure Deserialization - Cookies
      • Task 25 - Insecure Deserialization - Cookies Practical
      • Task 30 - Insufficient Logging and Monitoring
    • 📡Nmap
      • Task 2 - Introduction
      • Task 3 - Nmap Switches
      • Task 5 - TCP Connect Scans
      • Task 6 - Scan Types SYN Scans
      • Task 7 - UDP Scans
      • Task 8 - NULL, FIN and Xmas
      • Task 9 - ICMP Network Scanning
      • Task 10 - NSE Scripts Overview
      • Task 11 - Working with the NSE
      • Task 12 - Searching for Scripts
      • Task 13 - Firewall Evasion
      • Task 14 - Practical
    • 📡RustScan
      • Task 2 - Installing RustScan
      • Task 5 - Extensible
      • Task 7 - Scanning Time!
      • Task 8 - RustScan Quiz
    • 🐙Crack the hash
    • 🌍OhSINT
    • 🧑‍🚀Vulnversity
    • 🧊Ice
    • 🪟Blue
    • 🎄Advent of Cyber 4 (2022)
  • 🟨Difficulty: Medium
    • 🪟Attacktive Directory
      • Task 3 - Welcome to Attacktive Directory
      • Task 4 - Enumerating Users via Kerberos
      • Task 5 - Abusing Kerberos
      • Task 6 - Back to the Basics
      • Task 7 - Elevating Privileges within the Domain
      • Task 8 - Flag Submission Panel
    • 💀Mr Robot CTF
    • 🛗Linux PrivEsc
    • 🛗Linux PrivEsc Arena [WIP]
    • 🛗Windows PrivEsc Arena
  • 🟧Difficulty: Hard
    • 🐘Hacking Hadoop [WIP]
  • 🟥Difficulty: Insane
    • ⛺You're in a cave [WIP]
  • Blank Room (Duplicate Me)
Powered by GitBook
On this page
  • Task 7 [Severity 2] Broken Authentication Practical
  • What is the flag that you found in darren's account?
  • Now try to do the same trick and see if you can login as 'arthur'.
  • What is the flag that you found in arthur's account?
  1. Difficulty: Easy
  2. OWASP Top 10

Task 7 - Broken Authentication Practical

PreviousTask 5 - Command Injection PracticalNextTask 11 - Sensitive Data Exposure (Challenge)

Last updated 2 years ago

Task 7 [Severity 2] Broken Authentication Practical

What is the flag that you found in darren's account?

Reveal Flag

fe86079416a21a3c99937fea8874b667

Now try to do the same trick and see if you can login as 'arthur'.

No answer needed

What is the flag that you found in arthur's account?

Reveal Flag

d9ac0f7db4fda460ac3edeb75d75e16e

🟩
🐝
🚩
🚩
🚩
🚩