> For the complete documentation index, see [llms.txt](https://repo.4pfsec.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://repo.4pfsec.com/tryhackme/advent-of-cyber-3-2021/day-4-santas-running-behind.md).

# \[Day 4] Santa's Running Behind

{Web Exploitation = Fuzzing}

## Challenge

Accessing the site reveals a login form as shown below. 

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FJlB68IVmZlsTT3rEt9yu%2Fimage.png?alt=media\&token=1e2dcef5-c152-4c86-8e8e-61b1364e7fe9)

The following was the password list provided to us.

```
christmas
elves!
santa
festive
joy123
myrrh!
yuletide
presents
candy
tidings
cookie
cookies
biscuits!
snowball
snowball123
```

First, capture a dummy login request on burp and send it to the intruder

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2F5TvtAQPZjukZTjkou0Jh%2Fimage.png?alt=media\&token=065691cf-5dde-47e3-9d14-90d2f5c0b16a) ![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FekLyfM6n9p7qEi3mS2gO%2Fimage.png?alt=media\&token=21d6a9c8-52e9-4fba-a82b-e3f768b48755)

Mark the payload positions as shown below.

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FEShE9Cynfd7ZEGbbO1pj%2Fimage.png?alt=media\&token=4177ec8f-e617-4b47-999f-bb434a439954)

Paste the given wordlist under payload set 1 and start the attack.

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FYf8DDrBBgRu2bFUGz86h%2Fimage.png?alt=media\&token=479f06d3-edc2-4abd-824a-1b9507c45912)

After the attack has been completed. It's obvious that one request has a longer response and a status code of `302` AKA redirect.

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2Fzb49ipTLDL8wzitjlgT5%2Fimage.png?alt=media\&token=02ec99c7-0aa8-43d0-a18e-113b3fb78205)

Trying to login with `santa:cookie` succeeds and we are able to see Santa's Itinerary.

{% hint style="success" %}
What valid password can you use to access the "santa" account?

* cookie
  {% endhint %}

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FlLtcCvIx3mAXASUUJ3Yw%2Fimage.png?alt=media\&token=405a0e57-0cd5-4ad8-8a34-0f53cbdb7d95)

{% hint style="success" %}
What is the flag in Santa's itinerary?

* THM{SANTA\_\*\*\*\*\*\*\*}
  {% endhint %}