Advent of Cyber 2023: Day 4— Baby, it’s CeWLd outside (No Answers)

On Day 4 of TryHackMe’s Advent of Cyber 2023, the spotlight returns to Brute-Forcing. We’ll be focusing on two powerful tools, CeWL and WFuzz, which are instrumental in cyber security for generating custom word lists and assessing web application security, respectively.

CeWL — This tool is a custom word list generator. It spiders a URL, returning a list of words based on the site's content. This wordlist can then be used for brute-forcing passwords and credentials. What I quite like about CeWL is that you can specify the depth which means it will follow links and external links on pages creating a more in-depth wordlist. Here is an example of a CeWL command broken down:

WFuzz — This is a brute-forcing tool specifically designed for web applications. It replaces any reference to the “FUZZ” keyword used in a command with the given payload (so in this case the wordlist created by CeWL.

Tasks

Note: Whilst I really enjoyed the task for this day the write-up was very unmotivating so we are going to speedrun it…. hehe

What is the correct username and password combination? Format username:password

Looking around we see that there is a login page, this will be our first point of interest.

To try and brute force the credentials we are going to use CeWL to spider the site and create a password list:

I then re-ran the command but used the tag “-m 5” to only get words that are 5 characters or longer which will be used for a username wordlist.

Now that we have usernames and passwords to try brute force we can use WFuzz. Using a modified version of the command I demonstrated earlier we can have the tool FUZZ the username and Password field of the web application. After a while, we managed to get the login credentials.

What is the flag?

Once we have got the credentials for the login page we are greeted with the mailbox… inside here we will find the flag. Happy hunting!