Mother's Secret - TryHackMe -

[@jjann54321]

Thank you for taking the time to make this detailed analysis and walkthrough. While I do appreciate this room, having completed the modules leading up to this challenge DID NOT prepare me for this. Having a deep understanding of YAML, JS or using Burpsuite (as many people have in other write-ups) was not covered in the training and not mentioned as a "recommendation or prerequisite" for this challenge. Truthfully you didn't use any of the tools/techniques covered in the modules leading up this this challenge but your methodology certainly works well. I tried using OWASP ZAP but with limited success/results. I found this challenge quite frustrating and I can only assume many people feel the same way as I do as this is the lowest scoring (rated) room in the TryHackMe SecEng learning path. If someone would create a walkthrough/write-up using the tools/techniques covered in the training prior to this challenge that would be extremely helpful and appreciated. Thank you again and well done.

[@djalilayed]

Hi, the rooms on each TryHackMe path I think are just guidelines for general knowledge and tools you need on specific area, you need to practice more and learn more details, that is why each CTF room you try you will lean new things, in this room is more like manual code review, that is why I believe learning how to code is good if you planning to have career on hacking. So its combination of practice (doing rooms, ctf etc) and also learning (books, videos, online documentation) and here where most do the mistake, many they just do CTF rooms and do not spend more time on learning.

[@akashps3899]

I agree with you @jjann54321, I really got confused with this room! I was excited while starting but I felt like I didn't learn much with fun.

[@ShahriyarRzayev]

Cool room, cool explanation, probably next time better to zoom in the browser while sending a request or use burp with a bigger font size. Thanks for sharing :)

[@djalilayed]

Thanks for the tip, glad you enjoyed the video.

[@Hey-yk8pj]

Excellent explanation as always

[@djalilayed]

Thanks again!

[@yassinom2466]

thanks for the video, i have a question for ../../../../opt/m0ther, i don't understand this step, (how did you think about this)

[@pinchesteve4431]

Thanks for the walkthrough; as always, it was clear and helpful. I tried using Burp to do the POSTs, and can get the flags/secrets correctly from the OS (doing things in the correct order). But even though I can make the all the calls, the Role/Interface doesn't change from Crew Member (so I couldn't read the "classified flag"). Of course, your method works like a charm, but I'm still curious if there is something that I could do with Burp.

[@djalilayed]

Glad it helped!. I tried just now with burp, what I noticed is if you keep burp active on firefox using foxyproxy it will not update. So what I did is when I first captured the request using burp, I deactivated burp on firefox, refresh the page, then send request with burp as I did with firefox on my video, it will work

[@mebessusn]

Thank you for the help!

[@djalilayed]

Happy to help!

[@djalilayed]

Please subscribe to get the latest videos www.youtube.com/@djalilayed