Authors: Nathan Yam, Jonathan Kartawidjaja
When we first enter the website we are met with a simple dashboard with no other information in site.
You can try examining the website through page source and using tools like gobuster to directory bust, however those yield no results. Other tools you may try but won’t work here are nikto, wappalyser, and whatweb.
Additionally, if you enter the 127.0.0.1, or any other IP, the dashboard will result in an ERROR.
Fuzzing is the process of inputting special characters or specific input and examining how the web server responds.
We can try fuzzing the input field we are given with a special payload. For instance, we can try entering…
; whoami
&& whoami
|| whoami
Success, it appears that the second payload has yielded some output.