TryHackMe! Advent of Cyber Day 16 - Where's Santa?

[@AutumnSkerritt]

Good luck on the challenge today! I made it, hope you all have fun 🔥🔥

[@thengakola6217]

bruh that was awesome

[@idoabitoftrolling2172]

eyy beesec nice

[@nashonightmare]

Enjoyed it thanks

[@akashkashyap8445]

love the concept you have used to 🔥🔥 to make us learn the concept

[@BeerMunkii]

Very fun exercise, thanks!!! ^_^

[@bahai02]

The only reason why John Hammond is my favourite teacher is because the way he explained what each and every line of code does.....thanks a lot sir! And lots of love and support from North-east India

[@cooliceman0001]

I like that you speak to everyone. I really enjoy watching your videos. Thank you

[@donnieb390]

Hey John, really enjoyed this walk through. You have a great personality for the camera, you seem genuine and passionate about what you do. Keep up the good work. I look forward to following your content!

[@BlogTernet]

If any of you keep getting error: Couldn't find a tree builder with the features you requested: lxml. Do you need to install a parser library? This worked for me: pip3 install lxml Great Job John!

[@asalaa5752]

also you can use "html.parser" instead of lxml

[@BlogTernet]

@@asalaa5752 good to know! Thanks.

[@chef3215]

Thx John, for the enlightenment.

[@MarcelN1980]

bs4.FeatureNotFound: Couldn't find a tree builder with the features you requested: lxml. Do you need to install a parser library? You need to install lxml also on the machine, I think. just a pipe install lxml should suffice. I used the Attackbox, not some other default Kali machine and installing lxml solved the issue.

[@h4cker]

Thanks ☺️

[@akashkashyap8445]

To see John hammond doing walkthrough is always fun with lots of learning 🔥🔥

[@SDavies2010]

This is definitely not a beginner programming box.

[@ManSplained22]

your voice is too good it makes your videos even better

[@LapisOnTheMoon]

nice video! another way to solve href KeyError is passing href=True to the find_all function i found out :) keep up the good work

[@h8handles]

Cool addition with the tablet John

[@Sam-ux5rw]

I was very tempted to think, literally, outside the box and just run burp on the THM page for the question

[@ashiqurrahman275]

thanks

[@jasonallnutt5049]

Hi John, thanks for the video. Is the Attackbox suppose to already have beautifulsoup installed? When I ran the python script it kept telling me "no module names bs4". I tried to run the pip command but these attack boxes don't have internet, right?

[@docmalitt]

hi John, nice, very nice... now I've tried (too) many times learning python and didn't get far... or anywhere tbh. but if you decided to put a course or a larger video with you using python for all those ctf's, answers, tricks, challenges.. u used python (during your long yt career) in numerous videos where I can really see the full potential and power of python in real world env... now that would be something i would pay in gold (or whatever you youngsters use for trading these days)... i'm sure i'm not the only one thinking the same... it's always much easier leaning from examples (not skipping the proper learning curve, of course)

[@naeem8434]

Amazing

[@ihak070]

I actually loved the Python series. I was able to find my own solution and it makes me so happy. Really enjoyed this task :)

[@deepakkumawatwarrior7776]

Best of luck 👍

[@cursem4170]

Actually, i found IP/static/test. And the answer is just given inside. Is this also meant to be like this?

[@dannyv12]

I found the same thing. I'm also confused because they said you need python. If this is intended I'm really disappointed

[@leesugden9555]

Damn I spent a good hour before coming to your solution, I still have so much to learn when it comes to python

[@GuiltySpark]

ANSWER 3 AND 4 DO NOT WORK FOR ME on this day 16. How is this possible ? i got the same answers but when I copy paste them in to TryHack me it says incorrect

[@jamesLG1]

the room has been updated. the questions are swapped around.

[@bhupatithapa289]

Nice video bro

[@Fahodinho]

16:37 i don't get what `link["herf"]` did

[@NarendraS]

it will pick all the links with href attr

[@HACKPHILES]

Chill brother love you mahn,😘

[@WaseemLaghari]

love you too

[@kalifornia909]

how would you print only the api request that was valid in the python script

[@batbato9593]

If u check the output u just jave to say something like "if the json is not of the form {'item_id': XX, 'q': 'Error. Key not valid!'} then print"

[@code4720]

Anyone have a problem with the api script ? Does not return which key worked .

[@cimihan4816]

Nope, it works fine

[@code4720]

@@cimihan4816 didn't work for me

[@was3490]

#!usr/bin/python3 import requests import time import sys print(len(sys.argv)) if len(sys.argv) != 3: print("usage: \'python3 apikeyscanner.py [TARGET_IP] [TARGET_PORT]\"") sys.exit() target_ip = sys.argv[1] target_port = sys.argv[2] print(f"running against {target_ip}:{target_port}") for i in range(1,101,2): print(f"Checking: {i}",end=" - ") x = requests.get(f"{target_ip}:{target_port}/api/{i}") data = x.json() if "Error. Key not valid!" not in data["q"]: print(f"+++++++++ found key: {i}") print("content:",data["q"]) break elif "SANTA PROTECTION" in data["q"]: print(f"IP BLOCKED: {data['q']}") #continue if input("continue[y/N]") == "y" else break print("invalid",end=" ") time.sleep(5) +++++++++++ Edit: You might need to adjust the indentation bc of youtube.

[@ihak070]

@@code4720 Try this: import requests import json for i in range(100): if i % 2 == 1: response = requests.get('YOUR_MACHINE_IP:8000/api/' + str(i)) data = response.json() if data["q"] != "Error. Key not valid!": print(i) break

[@code4720]

@@ihak070 i will thanks

[@Inexpertamit]

I got port 80 open in http

[@MukeshSingh-ew7ld]

Here is a new task for you. Find out how many times I pressed that like button. (Hint : Its an odd number)

[@Twistidskull]

69

[@Lakshit.]

omg... 401 likes with 0 dislikes.. there u go ❤

[@thecscontent5110]

I also do videos about programming!😁