Walking An Application
This guide contains the answer and steps necessary to get to them for the Walking An Application room.
Table of contents
- Viewing The Page Source
- Developer Tools - Inspector
- Developer Tools - Debugger
- Developer Tools - Network
Viewing The Page Source
- What is the flag from the HTML comment?
If we access the page at: https://10.10.196.128.p.thmlabs.com we can view the page source. Here we find a comment that brings us to an unfinished page.
On this page we can find our flag.
Click for answer
THM{HTML_COMMENTS_ARE_DANGEROUS}
- What is the flag from the secret link?
On the same page source we can see there is a mention of a secret page. If we navigate to it we can find out flag.
Click for answer
THM{NOT_A_SECRET_ANYMORE}
- What is the directory listing flag?
After opening one of the external files of the website, we can try traversing to the parent folder to see if we can access any files.
Looks like we can!
Click for answer
THM{INVALID_DIRECTORY_PERMISSIONS}
- What is the framework flag?
Again on the page source, we see a comment about a framework used on the website.
Navigating to this page we can get more info about this framework. We find an admin panel which we can login to with the default credentials. However, this was not the correct flag.
After looking further, we see there is a file available to download from the changelog.
In this zip file, we can find our flag.
Click for answer
THM{KEEP_YOUR_SOFTWARE_UPDATED}
Developer Tools - Inspector
- What is the flag behind the paywall?
When looking at the source of the page in Inspector, we can search for the element that is blocking the text.
We could change the value of this element to not block the text. However, in this case, it also works by simply removing the element from the page.
Click for answer
THM{NOT_SO_HIDDEN}
Developer Tools - Debugger
- What is the flag in the red box?
Looking at the debugger tab, we can see the related javascript file.
Upon further inspection we see which part removes the message.
Adding a breakpoint here, allows us to see the message before it is removed.
Click for answer
THM{CATCH_ME_IF_YOU_CAN}
Developer Tools - Network
- What is the flag shown on the contact-msg network request?
On the contact page, we can submit some data this see what is retrieved.
Looks like we can find our flag in the response of the request.
Click for answer
THM{GOT_AJAX_FLAG}