Every Website Leaves Footprints Here is How I Followed Them

A complete walkthrough of INE eJPT CTF 1

eJPT is not my starting point, it is just another flag on my journey. Hey, I am Vamsi Kandukuru, a cybersecurity graduate. In this writeup we discuss my first Information Gathering CTF in eJPT. In this CTF room I did not face any tough challenges while solving because my previous hands-on skills helped me here. Let’s look at how I solved it.

Before starting this CTF assessment I understood and recalled my active and passive reconnaissance and started the CTF by selecting the VPN to access the machine. This CTF has a total of 5 flags.

Questions

1. This tells search engines what to and what not to avoid.

Understanding the question: when we open robots.txt we find ALLOW and DISALLOW. The actual thing is developers tell search engines not to show the DISALLOW path, but manually we can access the path. When it comes to sitemap.xml it provides the structure of the paths to the search engine.

Solution: We did not have any website link to solve this. First and most importantly you always need to know how many live hosts are in your network. Use Nmap to find the hosts. I observed a total of three hosts are alive. Find the services of all three hosts.

nmap -Pn 192.136.189.0/24               -   no of live hosts and services

192.136.189.3

After mapping the network I found only one active HTTP service running on 192.136.189.3. Although port 80 runs on 192.136.189.1 it is in a filtered state, which means there is a firewall filtering the traffic. I explored 192.136.189.3 in Firefox and got my target website. We need to find 5 flags from this website.

FLAG -1

Since we already understood the question, we directly headed to the robots.txt path. There we found some ALLOW and DISALLOW crawled paths and the FLAG. Copy the flag, paste it as the answer that’s it for Question 1.

2. What website is running on the target, and what is its version?

FLAG-2

Simple — here we need to find what website is running and its version. First understand the web technology and footprinting of a website using whatweb. We can also use Nmap for finding this but the CTF flag is our aim. Here I understood that it is using web server Apache 2.4.41, OS Ubuntu Linux, and WordPress version 6.5.3. Finally we got our flag.

3. Directory browsing might reveal where files are stored.

The flag is inside a directory but we don’t know the name of the directory. I found images on the target website, copied the link and removed the path one by one.

HEE HEE HEE

http://target.ine.local/wp-content/themes/twentytwentyfour/assets/images/building-exterior.webp

http://target.ine.local/wp-content/themes/twentytwentyfour/

http://target.ine.local/wp-content/

I used the dirb tool and found three paths — /themes, /uploads and /plugins. I used /uploads directly and found my 3rd flag. That’s it for Flag 3.

FLAG-3

4. An overlooked backup file in the webroot can be problematic if it reveals sensitive configuration details.

This hints at a backup file like .zip, .bak, .tar.gz sitting exposed in the web root.

• Try visiting: http://[target-ip]/backup.zip, /backup.tar.gz, /wp-config.bak, etc.
• Dirb/Gobuster with a good wordlist will find these
• Such files can leak database credentials, config files, source code

I visited /wp-config.bak and the file was downloaded to the Downloads folder in the Kali machine. I used grep to search for Flag 4.

FLAG-4

5. Certain files may reveal something interesting when mirrored.

Read the question carefully it says certain files may reveal something interesting when mirrored. My mind immediately thought we need to mirror the website and find the flag there. So I used HTTrack CLI, which has a very simple basic command to mirror a website.

mirror

1. httrack http://target.ine.local/ -O Mirror

2. grep -r "FL" target.ine.local

use the first command save the results in directory named as Mirror. Mirroring a website is nothing we having the local copy of a website HTML pages

• Images
• CSS files
• JavaScript
• Internal links
• Sometimes downloadable files

Then I used grep -r which matches the text we provide inside all files in the directory. Here is the FLAG-5.

FLAG -5

Five flags down.

Every flag taught me something different from a simple robots.txt to a forgotten backup file. That is the beauty of reconnaissance. The target tells you everything, if you know where to look.

See you in the next writeup. If this helped you, drop a clap it means a lot.

Follow for more

Linked-in