> For the complete documentation index, see [llms.txt](https://cyberkshetra.gitbook.io/noels-cyberkshetra-blogspace/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cyberkshetra.gitbook.io/noels-cyberkshetra-blogspace/wicys-cyberstart/chapter-1-amsterdam-a-running-start/wicys-cyberstart-amsterdam-challenge-4.md).

# WiCYS CyberStart (Amsterdam) Challenge 4

Disabled web-login

![](https://2368710584-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fq8Yzn5Spn9wAtMsEuJ0B%2Fuploads%2Fgit-blob-f989a99235a2685d687c301ab3c2a63265a54864%2FCS.png?alt=media)

## Briefing L01 C04

### Lazy Locked Login

![](https://2368710584-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fq8Yzn5Spn9wAtMsEuJ0B%2Fuploads%2Fgit-blob-ca343b6ea1039f03c94da89ee220a98ff1ec3521%2F1.png?alt=media)

> Our Dutch office recently bought a new Internet of Things (IoT) connected fridge. However, the temperature settings have been widely fluctuating as of late. All agents are currently out in the field and too busy to fix the problem.

> We know there is a remotely accessible technician’s page where fridge settings can be modified, and that the fridge’s login page isn’t very secure. It was easy enough to find the username and password, but the form still has some very lazy extra protection. Intern, can you see if the rumours are true, fix our fridge, and help us verify this reported security vulnerability?

> **Tip**: Successfully login to get the flag.

Proceed to the challenge

We are met with a remote fridge login page. Talk about sophisicated IOT Tech!

![The 'Enter' button is dimmed,sugesting that the credentials cannot be entered](https://2368710584-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fq8Yzn5Spn9wAtMsEuJ0B%2Fuploads%2Fgit-blob-516abfab35e6ccc96e6042c6b67b1cec9300a0e2%2F2.png?alt=media)

Having a look at the source code of the webpage, we can see the username and password values

As a side note, we can see that the page submission will be restricted, if not accessed from the technician's laptop

![Hmm,this left me stumped!](https://2368710584-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fq8Yzn5Spn9wAtMsEuJ0B%2Fuploads%2Fgit-blob-0930946981e416feda93b2f8fbbfcaed5ef37997%2F3.png?alt=media)

Any hint for Burpsuite use here? Even if this attempt fails, we can still find a way out. Tampering a packet is totally my thing. Let's use capture the request using Burp Proxy and then use Repeater to tamper the packet and to view the response

Turning on Intercept and loading the page, we are met with this intercepted packet

![](https://2368710584-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fq8Yzn5Spn9wAtMsEuJ0B%2Fuploads%2Fgit-blob-cddcecea07ef81294d302ad3825f97fd48e686aa%2F7.png?alt=media)

Alas, there are no parameters or fields for us to tamper. None of the available parameters can help us solve this quest!

There a door closes

We need some other method to edit the webpage. This can be achieved by Console Debugger

Right-click -> Inspect element

## Flag Capture

Keep expanding Highlight the keyword 'disabled' and delete it from the javascript

![Before tampering](https://2368710584-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fq8Yzn5Spn9wAtMsEuJ0B%2Fuploads%2Fgit-blob-93a1653b0796dbdfd91c6c148b2338e815f2a504%2F4.png?alt=media)

![After tampering](https://2368710584-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fq8Yzn5Spn9wAtMsEuJ0B%2Fuploads%2Fgit-blob-7f4930331664a78a9cb6cc95f75ceba4ae0ada83%2F4\(1\).png?alt=media)

The submit button gets highlighted, indicating to submit the credentials.

We log in successfully and capture the flag!

![](https://2368710584-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fq8Yzn5Spn9wAtMsEuJ0B%2Fuploads%2Fgit-blob-d91a12788b4f0b98bd793fc79563d5bf8d2a1d2f%2F5.png?alt=media)

> Flag — 6jdhphYBuCXs24YhoLkR

### Scoreboard

![](https://2368710584-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fq8Yzn5Spn9wAtMsEuJ0B%2Fuploads%2Fgit-blob-0ea5a6520085f5e341ee70ea4454ed92c42e29cf%2Fscreenshot%20\(3\).png?alt=media)

It's time to close down shop in the Amsterdam base and set it up somewhere else. Let's see where our CyberStart journey takes us.

Onward ahoy to the next challenge!

![](https://2368710584-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fq8Yzn5Spn9wAtMsEuJ0B%2Fuploads%2Fgit-blob-74537d5a3676192484d36383692738bb67c65e32%2F11.jpg?alt=media)