Natas20 – Jony Schats

Posted by Jony Schats on November 7, 2019 November 7, 2019 Writeups

Challange:
After logging in we see the same message as a couple challanges ago: You are logged in as a regular user. Login as an admin to retrieve credentials for natas21.

After having a look at the sourcecode I could not find something special. Lets input some names.

The value of PHPSESSID seems to be totally changing without any output:
– mvstor4443f13ka1vq99827906
– 4s83chrl0hfabukil5t7rpej63
Same when putting some input like “A”
– 6jhcl2screlh89nc8i5k6a7331
– ik2f4oi9dos276meogdc7a8dr1

To be honest I have no clue on how to complete this challenge. After reading a walkthrough I figured it might be a bit to hard for me to do now. I will go further with the Natas challanges after exploring some more experience with webapps.

Leave a Reply Cancel reply

Week in security with Tony Anscombe May 22, 2020
ESET research into Winnti Group's new backdoor – A dangerous Android app under the microscope – The BIAS Bluetooth bug The post Week in security with Tony Anscombe appeared first on WeLiveSecurity
Tomáš Foltýn
Insidious Android malware gives up all malicious features but one to gain stealth May 22, 2020
ESET researchers detect a new way of misusing Accessibility Service, the Achilles’ heel of Android security The post Insidious Android malware gives up all malicious features but one to gain stealth appeared first on WeLiveSecurity
Lukas Stefanko
How encryption can help protect your sensitive data May 22, 2020
Here’s how encryption can help keep your data safe from prying eyes – even if your device is stolen or your cloud account is hacked The post How encryption can help protect your sensitive data appeared first on WeLiveSecurity
Amer Owaida
Chrome 83 arrives with enhanced security and privacy controls May 21, 2020
New features include DNS over HTTPS, a Safety Check section and simpler cookie management The post Chrome 83 arrives with enhanced security and privacy controls appeared first on WeLiveSecurity
Amer Owaida
No “Game over” for the Winnti Group May 21, 2020
The notorious APT group continues to play the video game industry with yet another backdoor The post No “Game over” for the Winnti Group appeared first on WeLiveSecurity
Mathieu Tartare
These things may be cool, but are they safe? May 20, 2020
In the rush to embrace IoT devices, we shouldn’t trade in our privacy and security for the added convenience The post These things may be cool, but are they safe? appeared first on WeLiveSecurity
Amer Owaida
Bluetooth flaw exposes countless devices to BIAS attacks May 19, 2020
As many as 30 different smartphones, laptops and other devices were tested – and all were found to be vulnerable The post Bluetooth flaw exposes countless devices to BIAS attacks appeared first on WeLiveSecurity
Amer Owaida
European supercomputers hacked to mine cryptocurrency May 18, 2020
Several high-performance computers working on COVID-19 research have been forced offline following a string of attacks The post European supercomputers hacked to mine cryptocurrency appeared first on WeLiveSecurity
Amer Owaida