CTFHUB Basic Certification

Download the title attachment - click on the link

 Click click - get a pop-up window

Just enter the account password

 ctfhub123456

Directly use burp suite to capture packets and capture a string of base64;

 Decode with base64:

Y3RmaHViOjEyMzQ1Ng==

Get ctfhub:123456, what we capture the packet is the account number and password we just entered;

Then send it to intruder——Payloads, add the password that needs to be blasted

 

 

 

 Import password book 10_million_password_list_top_100.txt

The account should be quite simple, and I plan to use the three accounts of ctfhub\admin\user to blast

Payload Processing——Add——Prefix (prefix)——ctfhub/admin/user: (for convenience, you have to enter one by one)

 

 In the process of capturing packets, what we captured was base64, so the text format we blasted should also be base64

 Turn off Payload Encoding

 Start attack start blasting

Get a status code of 200

 base64 decoding to get: ashley

Then log in to your account to get the flag