Cyberheroes — Authentication Bypass Through Source Code Analysis

Platform: TryHackMe / CTF Target: 10.49.142.147 Difficulty: Easy

Some boxes trick you with rabbit holes. This one tells you exactly where the vulnerability is — and I still didn’t believe it. That says more about me than the box.

The landing page says: “Find the vuln on our login page and login to join us.”

I assumed it was a trap. It wasn’t.

Reconnaissance

Only two ports exposed.

$ sudo nmap -sS -Pn -p- --min-rate 5000 10.49.142.147

PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http

No hidden services. No unusual ports. The attack surface is a single web page and an SSH endpoint. This is a web challenge, and the answer is probably on the page itself.

I skipped gobuster and directory enumeration — if the challenge says “bypass the login,” I should look at the login first.

Source Code Review

The login page is clean. A username field, a password field, a button. Nothing unusual in the rendered view.

But the source code tells the whole story.

function authenticate() {
  a = document.getElementById('uname')
  b = document.getElementById('pass')
  const RevereString = str => [...str].reverse().join('');
  if (a.value=="h3ck3rBoi" & b.value==RevereString("54321@terceSrepuS")) {
    var xhttp = new XMLHttpRequest();
    xhttp.onreadystatechange = function() {
      if (this.readyState == 4 && this.status == 200) {
        document.getElementById("flag").innerHTML = this.responseText;
        document.getElementById("todel").innerHTML = "";
        document.getElementById("rm").remove();
      }
    };
    xhttp.open("GET", "RandomLo0o0o0o0o0o0o0o0o0o0gpath12345_Flag_"
      + a.value + "_" + b.value + ".txt", true);
    xhttp.send();
  }
  else {
    alert("Incorrect Password, try again.. you got this hacker !")
  }
}

Two things stand out immediately:

1. The credentials are in cleartext. The username is h3ck3rBoi. The password is a reversed string.
2. The flag endpoint is predictable. Once authenticated, it fetches a file with a naming convention based on the credentials.

The password is the only twist. The string 54321@terceSrepuS needs to be reversed:

54321@terceSrepuS → SuperSecret@12345

Authentication Bypass

Credentials:

• Username: h3ck3rBoi
• Password: SuperSecret@12345

Enter them into the login form, click submit, and the page returns the flag without a page reload.

No SQL injection. No directory brute-forcing. No session manipulation. Just reading what was already there.

Lessons Learned

• Client-side auth is not security — Anything in JavaScript is public. Obfuscation and string reversal are not encryption.
• Read the source code first — Before running tools, check what the page gives you for free.
• Trust the challenge description — When the challenge says “bypass the login page,” it means it. Not everything is a red herring.
• The simplest path is usually correct — I spent more time doubting the solution than finding it.

Cheatsheet

# Recon
nmap -sS -Pn -p- --min-rate 5000 <target>

# Source code review (browser: Ctrl+U or DevTools)
# Found in login.html:
#   username: h3ck3rBoi
#   password: RevereString("54321@terceSrepuS") = "SuperSecret@12345"
#   flag endpoint: RandomLo0o0o0o0o0o0o0o0o0o0gpath12345_Flag_<user>_<pass>.txt

# Or from the terminal:
# Reverse the password string
echo "54321@terceSrepuS" | rev

# Direct flag retrieval
curl "http://<target>/RandomLo0o0o0o0o0o0o0o0o0o0gpath12345_Flag_h3ck3rBoi_SuperSecret@12345.txt"