Authors: Nathan Yam, Jonathan Kartawidjaja
When we first enter the website, we are met with a simple login portal.
Upon further examination there is not much to do. You can attempt entering default credentials, or looking for SQL injection. You may also wish to test hydra, burp suite, or SQLMap, on the page, but those will not yield results.
We can try viewing the page source by right clicking on it, and clicking on view page source. Or by prepending the URL with view-source:, in this case: view-source:[<https://wcsc-very-secure-login-portal.chals.io/>](<https://wcsc-very-secure-login-portal.chals.io/>).
There is not much of interest in this case. However, it appears that the website is referencing a javascript login file. We can visit it by clicking on the underlined text.
In this case it appears that the JavaScript code is obfuscated.
Code Obfuscation refers to making code hard to read for humans, but still understandable by computers and machines.
To de-obfuscate code, we can use the following website: https://beautifier.io/
We simply need to paste in the obfuscated JavaScript and select Detect packers and obfuscators:
