# MISCHIEF!
## CTFRoom!
## @Author : M3tr1c_r00t

### Enumeration...
Gobusterscan...
<br> After the scan, we were able to identify the server running on php....

┌──(kali㉿kali)-[~/Desktop/ctfroom]
└─$ ffuf -u http://176.32.72.206/FUZZ -w /usr/share/wordlists/dirb/common.txt -mc all -fw 2

        /'___\  /'___\           /'___\       
       /\ \__/ /\ \__/  __  __  /\ \__/       
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\      
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/      
         \ \_\   \ \_\  \ \____/  \ \_\       
          \/_/    \/_/   \/___/    \/_/       

       v1.5.0 Kali Exclusive <3
________________________________________________

 :: Method           : GET
 :: URL              : http://176.32.72.206/FUZZ
 :: Wordlist         : FUZZ: /usr/share/wordlists/dirb/common.txt
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: all
 :: Filter           : Response words: 2
________________________________________________

.htaccess               [Status: 403, Size: 278, Words: 20, Lines: 10, Duration: 248ms]
.swf                    [Status: 404, Size: 275, Words: 23, Lines: 10, Duration: 263ms]
                        [Status: 200, Size: 2910, Words: 187, Lines: 73, Duration: 264ms]
.profile                [Status: 200, Size: 442, Words: 34, Lines: 5, Duration: 1947ms]
.hta                    [Status: 403, Size: 278, Words: 20, Lines: 10, Duration: 3954ms]
.htpasswd               [Status: 403, Size: 278, Words: 20, Lines: 10, Duration: 4258ms]
build                   [Status: 301, Size: 314, Words: 20, Lines: 10, Duration: 239ms]
crossdomain.xml         [Status: 404, Size: 275, Words: 23, Lines: 10, Duration: 252ms]
favicon.ico             [Status: 404, Size: 275, Words: 23, Lines: 10, Duration: 587ms]
forgot                  [Status: 200, Size: 2641, Words: 187, Lines: 66, Duration: 524ms]
home                    [Status: 200, Size: 1550, Words: 74, Lines: 18, Duration: 420ms]
index                   [Status: 200, Size: 2910, Words: 187, Lines: 73, Duration: 422ms]
index.html              [Status: 404, Size: 275, Words: 23, Lines: 10, Duration: 420ms]
index.php               [Status: 200, Size: 2910, Words: 187, Lines: 73, Duration: 418ms]
javascript              [Status: 301, Size: 319, Words: 20, Lines: 10, Duration: 343ms]
login                   [Status: 200, Size: 2716, Words: 173, Lines: 70, Duration: 416ms]
phpmyadmin              [Status: 403, Size: 278, Words: 20, Lines: 10, Duration: 333ms]
player.swf              [Status: 404, Size: 275, Words: 23, Lines: 10, Duration: 487ms]
profile                 [Status: 200, Size: 1553, Words: 73, Lines: 18, Duration: 528ms]
robots.txt              [Status: 404, Size: 275, Words: 23, Lines: 10, Duration: 260ms]
server-status           [Status: 403, Size: 278, Words: 20, Lines: 10, Duration: 389ms]
sitemap.xml             [Status: 404, Size: 275, Words: 23, Lines: 10, Duration: 402ms]
swfobject.js            [Status: 404, Size: 275, Words: 23, Lines: 10, Duration: 425ms]
temp                    [Status: 301, Size: 313, Words: 20, Lines: 10, Duration: 422ms]
themes                  [Status: 301, Size: 315, Words: 20, Lines: 10, Duration: 386ms]
vendor                  [Status: 301, Size: 315, Words: 20, Lines: 10, Duration: 385ms]
web.xml                 [Status: 404, Size: 275, Words: 23, Lines: 10, Duration: 323ms]
:: Progress: [4614/4614] :: Job [1/1] :: 118 req/sec :: Duration: [0:00:57] :: Errors: 0 ::

After that, we can now visit the site and we find a signup page....
<br> We can create an account and proceed to the next stage...

Login
<br>

After a quick look at the source code, i saw that there we some fields that were hidden...

And with that we've finally found our foothold.....
<br> This is because the userid parameter is visible and is also included when sending the request to change the email and the user id can be manipulated to change the email of a different user....
<br> So now we are gonna capture the request using burp suite and change the userid which was base64 encoded.....


So on burp request, change your email, then change the userid,
Next, forward the request.....

After that, log out then go to the forgot password section and enter the new email....


Reset the password.....

Then login with the new creds that you have....
And boom!, we've gotten our flag....

## My socials:
<br>@ twitter: https://twitter.com/M3tr1c_root
<br>@ instagram: https://instagram.com/m3tr1c_r00t/