[f4k3h4ck3r]

Let's talk guys - https://app.hackthebox.com/machines/Ghost

[Leonzola]

http://ghost.htb:8008/ghost/

[chewablechunk01]

http://ghost.htb:8008/ghost/api/content/...38c83aaca6

maybe we could get an IDOR

[chewablechunk01]

http://ghost.htb:8008/ghost/api/content/...38c83aaca6

maybe we could get an IDOR

How did you get the key?

inspect the network taffic and click the search Icon. You should see a request to the api.

[disavowed913]

http://ghost.htb:8008/ghost/

did you try sqlmap on it?

[Leonzola]

http://ghost.htb:8008/ghost/

did you try sqlmap on it?

Doing it now.

[jsvensson]

there is also intranet.ghost.htb on port 8008
and core.ghost.htb on port 8443

[Uliys]

Anything interesting in http://ghost.htb:8008/ghost/api/content/posts ?

[ritualist]

http://intranet.ghost.htb:8008

User: kathryn.holland
Secret: *

Yes, just *

It works for all users. Maybe it's treated like a wildcard and we can bruteforce a*, b*, etc.


There's also http://gitea.ghost.htb:8008/

[Uliys]

http://intranet.ghost.htb:8008

User: kathryn.holland
Secret: *

Yes, just *

It works for all users. Maybe it's treated like a wildcard and we can bruteforce a*, b*, etc.


There's also http://gitea.ghost.htb:8008/

How did you find this?