Published on December 14, 2021Updated on January 14, 2022
Hint Given:- Wordlists will help you find something to do
gobuster dir -w wordlist.txt -u http://188.8.131.52/89092085dd/api/v1
Hint Given:- If a GET doesn’t do anything, try a different HTTP verb
Hint Given Maybe you can edit your profile? but what fields can you change?
Hint Given Sometimes developers hide extra features into a page… but how can you access it?
ffuf -u http://184.108.40.206/4f6cd6f1ea/api/v1/status?FUZZ=demo -w wordlist.txt -fs 1-20 -s
Have you read the new version of the API's documentation?
How can you use the same session across multiple different instances and versions?
Some features were never quite finished properly in some versions
Take a close look at the returned headers from all of your endpoints, is there anything different about one of them? Maybe there's a second server somewhere? Possibly we can get access to things higher up...