TryHackMe - Capture!

Table of Contents

1. Reconnaissance
2. Bypassing Captcha

Reconnaissance

1. The first step to brute-force the login page, is enumerating valid users.
2. We can use the websites message error for this:
   • The user 'test' does not exist
3. However, when we try too many invalid attempts, the website requests the user to solve a captcha:
   • 
4. Fortunately, the captcha only requires solving a simple math expression, which we can bypass using Python.

Bypassing Captcha

The way I bypassed the captcha using Python is as follows:

1. Send a Post Request.
2. Use Regex to grab the captcha’s math expression.
3. Use eval() function to calculate the math expression.
4. Send a new Post Request with the captcha’s solution.

After bypassing the captcha, I created a Python script to automatically enumerate a valid username and password. You can read it here: script

• 
• 
• Note that it should take you some minutes to get the right credentials.

Next, I used the credentials I found to login in the website and got the flag:

•