Modern Web Stacks| TryHackMe | practical lab

Four web stacks, four CVEs: fingerprint MERN, Next.js, Django, and LAMP, then exploit each one.

The workflow for every task in this room is the same: identify the stack from observable signals, confirm the version, understand why the vulnerable code pattern exists, and then execute the exploit chain.

Learning Objectives

You should have an understanding of the following rooms before starting:

• Identify a web stack from passive HTTP signals (headers, cookie names, error pages, URL structure) without sending exploit payloads
• Exploit CVE-2025-29927 to bypass Next.js middleware authentication
• Exploit CVE-2021-35042 to extract database contents from a Django application
• Exploit CVE-2021-41773 to read arbitrary files and execute system commands via mod_cgi on Apache 2.4.49

🛠️ Type: Walkthrough

👤 Role: Pentest

💪 Difficulty: Easy

🔗Link : https://tryhackme.com/room/modernwebstacks

The target machine is an Ubuntu 22.04 VM running four services: port 3000 (MERN/Express), port 3001 (Next.js/RSC), port 8000 (Django), and port 8080 (Apache 2.4.49 in a Docker container). All four ports are reachable from the AttackBox via the split-view connection.

What HTTP response header confirms an Express.js backend is running? (Answer Format: Header-Name: Value)

X-Powered-By: Express

What is the name of the Express session cookie you will use to replay requests after polluting the prototype? (Answer Format: cookie-name)

Send the prototype pollution payload to the merge endpoint. What is the flag returned by the admin route after the bypass succeeds?

What HTML artifact in the page source confirms a Next.js App Router application?

window.__next_f

Send the CVE-2025–29927 bypass header to the protected /dashboard route. What flag is displayed on the page? (Answer Format: THM{...})

What hidden form field in Django POST forms is a near-certain stack fingerprint?

Using manual curl payloads, what is the name of the vulnerable database?

What exact Server header value identifies this target as vulnerable to CVE-2021–41773? (Answer Format: Apache/X.X.XX (OS)

What curl flag is required to prevent curl from normalising the traversal sequences in the URL before sending?

— path-as-is

What are the contents of the flag.txt file?

https://tryhackme.com/room/modernwebstacks