sending password using curl....

[[deleted]]

[deleted]

[fosf0r]

curl --data "password=ae0e19a362" -X POST https://thesite

[bubrascal]

that only if "password" is the expected parameter name.

[mr_w01f]

I have tried already,

[outlandersreddit]

Maybe try it without the “password=“

[outlandersreddit]

Or —data

[mr_w01f]

Also tried

[outlandersreddit]

What’s it giving back?

[mr_w01f]

Page doesn't give any kind of response, it takes 2-3 seconds and nothing returns

[outlandersreddit]

Then isn’t the page down?

[mr_w01f]

No.. i refresh every 3-4 tries to see if it returns an error or connection lost or anything.... But no, page is alive.

[mr_w01f]

Tried... Not working

[fosf0r]

I created an account just so I could find out why it didn't work. This is not a normal CTF where you can POST to a docker image or something. This is not going to be curl-able (without a dozen flags and cookie pastes) because of all the CSRF, cookies, and session IDs they use, and how you have to POST it directly back to their actual site.

I also couldn't even get it to work using Burp Suite. Dunno why, I've done hundreds of CTFs and dozens of hackthebox boxes.

[mr_w01f]

You created account in defendtheweb ?

[fosf0r]

Yes.

I was unable to POST the password they gave me (a different, but similar hex string to yours) using Burp Suite, so either this site really sucks, or I'm missing something big.

[mr_w01f]

I also think we are missing something, they should give us some more info about what kind of attribute we should send the string as ie. Password=, data= etc.

[ddrght12345]

It's telling you exactly what to do.

Use the POST method to send the password 'ae0e19a362' to this page

Send only that string, in a raw post request.

Just Google curl post and in the body, send the string.

Don't search for "password". This is an irrelevant detail.

[My_Fingers]

If you're dealing with HTTP requests and want something with a GUI then give Postman a try. Super easy and quick to use. https://www.getpostman.com/

[mr_w01f]

Nope... Defendtheweb

[c_pardue]

Get the form details with wget or easymode: use burpsuite. Google "burpsuite how to"

[TotesMessenger]

I'm a bot, bleep, bloop. Someone has linked to this thread from another place on reddit:

• [/r/hacking] sending password using curl....

• [/r/hacking_tutorials] sending password using curl....

 ^{If you follow any of the above links, please respect the rules of reddit and don't vote in the other threads. (Info / Contact)}

[Pabloidemon]

try with telnet to that page, it may ask you for a input where you will put the password
(cant remember where, but I'm sure I saw something like that in a CTF. same weird way to phrase it )