TUTORIAL Weather App [Discussion]
by n3m3n91 - February 03, 2021 at 10:53 AM
#1
Hello everyone.

has anyone done this challenge?
Reply
#2
Yes I have solved weather app
Reply
#3
how did you bypass the localhost restriction? I was thinking about doing it by passing through the weather api but I did not understand how to do it yet
Reply
#4
(February 03, 2021 at 01:58 PM)test12377 Wrote: how did you bypass the localhost restriction? I was thinking about doing it by passing through the weather api but I did not understand how to do it yet

you can give the weather api a URL with unicode characters that will turn into newlines and spaces to inject a second HTTP request. i've got that part and the SQL injection down, but for some reason req.socket.remoteAddress is always undefined instead of 127.0.0.1 and fails

(February 03, 2021 at 11:38 AM)Iknowitsme Wrote: Yes I have solved weather app

mind sliding into my DMs with the part i'm missing?
Reply
#5
Have found out how to inject newlines, which is then send as a single frame with multiple http request, but it's only the first one that is accepted. What am I doing wrong?
Reply
#6
what are you using as a newline?
Reply
#7
(February 03, 2021 at 11:38 AM)Iknowitsme Wrote: Yes I have solved weather app

Hi, I hope are you well , how did you bypass the new line to register and get sqli thank you!
Reply
#8
(February 03, 2021 at 11:38 AM)Iknowitsme Wrote: Yes I have solved weather app

Hey, Can you please share weather app flag?
Reply
#9
I have started doing HTB. Really Happy to see that people discuss flags and ways to get them
Reply
#10
Hey Guys can you please give me a little nudge in the right direction please? I know we have to user /api/weather but how can I add an request to it is out of my understand? can you please help a noob out please.
Reply
#11
(February 17, 2021 at 02:07 PM)megashow Wrote: I have started doing HTB. Really Happy to see that people discuss flags and ways to get them

Hey mate, Did you solve weather app? I am stuck at it.
Reply
#12
(February 17, 2021 at 02:07 PM)megashow Wrote: I have started doing HTB. Really Happy to see that people discuss flags and ways to get them

I read some articles about http smuggling and successful to send register request while send request to api/weather, but req.socket.remoteAddress is undefined. Is my direction correct?
Reply

Possibly Related Threads…
Thread Author Replies Views Last Post
TUTORIAL HTB pivotapi [DISCUSSION] pheonix2021 41 6,878 34 minutes ago
Last Post: paulwatson42016
TUTORIAL HTB Fortress Synacktiv (DISCUSSION) pheonix2021 18 3,688 May 08, 2021 at 11:57 AM
Last Post: teksius
TUTORIAL ATTENDED [DISCUSSION] 0xvijay 91 26,869 May 08, 2021 at 07:26 AM
Last Post: Destroy3r3

 Users browsing this thread: 2 Guest(s)