Natas20 – Jony Schats

Posted by Jony Schats on November 7, 2019 November 7, 2019 Writeups

Challange:
After logging in we see the same message as a couple challanges ago: You are logged in as a regular user. Login as an admin to retrieve credentials for natas21.

After having a look at the sourcecode I could not find something special. Lets input some names.

The value of PHPSESSID seems to be totally changing without any output:
– mvstor4443f13ka1vq99827906
– 4s83chrl0hfabukil5t7rpej63
Same when putting some input like “A”
– 6jhcl2screlh89nc8i5k6a7331
– ik2f4oi9dos276meogdc7a8dr1

To be honest I have no clue on how to complete this challenge. After reading a walkthrough I figured it might be a bit to hard for me to do now. I will go further with the Natas challanges after exploring some more experience with webapps.

How I hacked my friend’s PayPal account January 24, 2022
Somebody could easily take control of your PayPal account and steal money from you if you’re not careful – here's how to stay safe from a simple but effective attack The post How I hacked my friend’s PayPal account appeared first on WeLiveSecurity
Jake Moore
Week in security with Tony Anscombe January 21, 2022
ESET research into Donot Team attacks – Common signs that your email has been hacked – Social media dos and don'ts in the workplace The post Week in security with Tony Anscombe appeared first on WeLiveSecurity
Editor
How to know if your email has been hacked January 20, 2022
Think your email may have been hacked? Here are the signs to look for, how account takeover attacks commonly occur, and how to recover your account and avoid falling victim again The post How to know if your email has been hacked appeared first on WeLiveSecurity
Phil Muncaster
DoNot Go! Do not respawn! January 18, 2022
ESET researchers take a deep look into recent attacks carried out by Donot Team throughout 2020 and 2021, targeting government and military entities in several South Asian countries The post DoNot Go! Do not respawn! appeared first on WeLiveSecurity
Facundo Muñoz
Social media in the workplace: Cybersecurity dos and don’ts for employees January 17, 2022
Do you often take to social media to broadcast details about your job, employer or coworkers? Think before you share – less may be more. The post Social media in the workplace: Cybersecurity dos and don’ts for employees appeared first on WeLiveSecurity
Amer Owaida
Week in security with Tony Anscombe January 14, 2022
How malware exploits security flaws in kernel drivers – Watch out for cryptocurrency scams – Why loyalty accounts are a target for criminals The post Week in security with Tony Anscombe appeared first on WeLiveSecurity
Editor
Making loyalty pay: How to keep your loyalty rewards safe from scammers January 13, 2022
Is loyalty fraud on your radar? Here's why your hard-earned reward points and air miles may be easy pickings for cybercriminals. The post Making loyalty pay: How to keep your loyalty rewards safe from scammers appeared first on WeLiveSecurity
Phil Muncaster
Cryptocurrency scams: What to know and how to protect yourself January 12, 2022
As you attempt to strike it rich in the digital gold rush, make sure you know how to recognize various schemes that want to part you from your crypto The post Cryptocurrency scams: What to know and how to protect yourself appeared first on WeLiveSecurity
Phil Muncaster