Navigation

**home | writeup**

</aside>

Quote

“The biggest room in the world is the room for improvement“ – Helmut Schmidt

</aside>

i. Table of Content

</aside>

</aside>

ii. TL;DR

</aside>

<aside> 💡

The Insomnia web challenge involves exploiting an authentication bypass vulnerability in a PHP CodeIgniter application. The login endpoint fails to properly validate JSON request fields, allowing authentication as administrator by sending a request with "username" but omitting "password". This grants access to view the flag in the profile page. The vulnerability stems from improper input validation where the login function only checks for exactly two JSON keys without verifying which specific keys are present.

</aside>

iii. Pwn3d

</aside>

Owned Insomnia from Hack The Box!

Pwned

1. Analysis

</aside>

1.1 Source Code

</aside>

1.1.1 Dockerfile

</aside>

The application runs on PHP 8.1 and Apache web server as described in the Dockerfile.

Dockerfile

1.1.2 entrypoint.sh

</aside>

In entrypoint.sh, a database named insomnia.db is created with a single table called "user" containing username and password columns. The script then inserts a row with the username "administrator" and a randomly generated password. Additionally, the JWT_SECRET is dynamically generated using OpenSSL. This means that neither bruteforcing the administrator password nor the JWT_SECRET is a viable approach.

entrypoint.sh

1.1.3 Code Igniter

</aside>