Thread by @maikroservice

Day 4⃣0⃣

Today we will start hacking the application we selected yesterday.

In my case it was farmOS - you might have choosen a different Open Source Software you found on github - which is fine, the methodology is the same.

What to do first?

Right, start the application…

Recap:

We installed @Docker so that we can automagically have it running without headaches.

Now make sure that docker is running and type

docker ps

into your terminal. Your output should look similar to this one (the CONTAINER ID, PORTS and NAMES might look differently)

Good now go to your web browser and type

localhost

You might be greeted with this error - I just refreshed the page and it was gone - MAGIC! 🪄

Next we need to select a database:
I choose SQLite which is a database that consists of a single file on the disk.
Really smooth and easy to setup - one click and done.

Save and continue

now farmOS installs itself...

and asks us which modules we want to select...

since I have no idea what all the modules do, I just select ALL OF THEM 😅

Save and continue

We are almost finished

Now we hack. 🏴‍☠️🏴‍☠️🏴‍☠️

Question 1:
What do we look for?

Answer 1:
We need to understand what we are looking at here - so let's find out the tech stack first

Enter Wappalizer Browser Extension: chrome.google.com/webstore/detai…

We find Drupal (Version 9), Apache (Version 2.4.54) and PHP.

What are those?

Drupal is @drupal - a php based open source Content Management System (CMS)

A github search shows us the source code of Drupal and the current version (9.5.x) github.com/drupal/drupal

Google also shows us that apache 2.4.54 is the current version of the web server - httpd.apache.org

Now comes your task for today - figure out if there are any vulnerabilities / CVEs reported for:

1. farmOS
2. Drupal 9.5.x
3. apache 2.5.54

You will win a prize.

1 month of free @hackthebox_eu premium VIP or @tryhackme subscription (your choice) - paid by me.

All you have to do is reply to this tweet with the answers - I will select the winner in the thread tomorrow.

Tomorrow we will look for XSS - cross site scripting vulnerabilities - if you want to have more homework, try fuzzing all input fields.

If you don't know what that means - I will share it tomorrow.

#BugBounty #30DaysOfBugBounty

Oh and if you want to learn more about:

Bug Bounty methodology in October

Blue Team topics in November

Finding a job in Cyber Security in December

Make sure to click that follow button. Thank you!