Enumerate a target web application, observe open ports, and obtain a flag.

Execution & Troubleshooting

1. Initial Scanning

I attempted to run an nmap scan against the target ip, but all scanned ports returned as ignored/filtered (presumably because of firewall configurations). This led to me pivoting directly toward opening the target IP in the browser and enumerating web services instead.

2. Testing Default Credentials

Upon loading the web page, I located a login page with a username and password field:

Seeing this, I attempted multiple common credential configurations such as guest:guest or admin:admin. None of these worked, so I was then prompted to enumerate the source code of the web page instead.

3. Source Code Inspection & Exploitation

Since default credentials failed, I opened up the source code of the login page using ctrl+u. This allowed me to find a script in the source code operating the login form:

The aforementioned script defines two variables: a (the username) and b (the password). In order to successfully log in, a user must enter the username h3ck3rBoi and the password SuperSecret@12345 (since the string is reversed). Doing so leads to a flag page as well as a congratulations: