> For the complete documentation index, see [llms.txt](https://repo.4pfsec.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://repo.4pfsec.com/tryhackme/advent-of-cyber-3-2021/day-4-santas-running-behind.md).

# \[Day 4] Santa's Running Behind

## Challenge

Accessing the site reveals a login form as shown below. 

![](/files/sdQamYK8eWzc7607AjS2)

The following was the password list provided to us.

```
christmas
elves!
santa
festive
joy123
myrrh!
yuletide
presents
candy
tidings
cookie
cookies
biscuits!
snowball
snowball123
```

First, capture a dummy login request on burp and send it to the intruder

![](/files/f5fvNMxEdN83BTwK3TZd) ![](/files/fWbe9XMYouHlLOwNonZv)

Mark the payload positions as shown below.

![](/files/edOVJavcBZR9i3T6SYVy)

Paste the given wordlist under payload set 1 and start the attack.

![](/files/MC3LkgCYHbIuEs4Cz5rC)

After the attack has been completed. It's obvious that one request has a longer response and a status code of `302` AKA redirect.

![](/files/CLQiaXINf7BfIdUSpQkt)

Trying to login with `santa:cookie` succeeds and we are able to see Santa's Itinerary.

{% hint style="success" %}
What valid password can you use to access the "santa" account?

* cookie
  {% endhint %}

![](/files/vDvyfKkTxGXGNv4DT9Cv)

{% hint style="success" %}
What is the flag in Santa's itinerary?

* THM{SANTA\_\*\*\*\*\*\*\*}
  {% endhint %}