Hackthebox academy
Author: Stefan Waldvogel
HTB Academy is a great place to start your Cybersecurity career
-HTB Academy is updating their infrastructure-
-you will run in problems right now---
Do you love the red side of Cybersecurity?
You should know HackTheBox and their academy. The academy is a starting point and you can learn a lot of penetration testing skills for free. If you like it, you can move on and pay for more advanced topics.
At the beginning this is not necessary and you can do 15 free modules. Some of them are:
I will use the module "Web requests" for this guide. The reason is, I need this knowledge for the blue and the red side.
Getting started
Create an account with this link: academy.hackthebox.eu/register. If you have a student email, you should use the email because you get access to better deals. The interface is simple to use and looks like this:
-you will run in problems right now---
Do you love the red side of Cybersecurity?
You should know HackTheBox and their academy. The academy is a starting point and you can learn a lot of penetration testing skills for free. If you like it, you can move on and pay for more advanced topics.
At the beginning this is not necessary and you can do 15 free modules. Some of them are:
- Linux Fundamentals
- Buffer Overflow
- SQL Injection
- Web Requests
- and much more.
I will use the module "Web requests" for this guide. The reason is, I need this knowledge for the blue and the red side.
Getting started
Create an account with this link: academy.hackthebox.eu/register. If you have a student email, you should use the email because you get access to better deals. The interface is simple to use and looks like this:
The free modules are Tier 0. You have to pay 10 cubes for each module, but if you finish a module will get 10 cubes back.
Start with "Web Requests"
Unlock the module, pay 10 cubes and start the lab. Like all modules, this is about learning and nos so much about getting the points. In this module, you learn a lot about HTTP requests. Later, you need this knowledge in many different areas.
Maybe you are a SOC Analyst and knowledge about HTTP is essential to understand web traffic. Most companies use HTTPS, but after a decryptor, the traffic is still visible.
Start with "Web Requests"
Unlock the module, pay 10 cubes and start the lab. Like all modules, this is about learning and nos so much about getting the points. In this module, you learn a lot about HTTP requests. Later, you need this knowledge in many different areas.
Maybe you are a SOC Analyst and knowledge about HTTP is essential to understand web traffic. Most companies use HTTPS, but after a decryptor, the traffic is still visible.
|
|
This modules is very simple and you get the big idea about what is happening if you use a browser. Most modules have a hands-on area and you can create a prepared machine.
For beginners, this is a huge advantage, because you just use the software. The disadvantage is, if you want to try this at home, you do not know how to do it.
My advice is: Start simple and use the given machine but later try to use your own Kali or Parrot. The reason is, if you get a job, you have to know more about troubleshooting and the installation of these tools.
THB Academy works like this: Read the material, get the first impression, and now start the machine and do it again with hands-on. Starting an instance takes a couple of seconds.
Start an instance
Read everything including the Request and Response section. At the end of this section is machine and you start it. The machine at the end is inconvenient, but change a setting at the bottom and the machine runs in a different and new window. Now you can work side by side.
For beginners, this is a huge advantage, because you just use the software. The disadvantage is, if you want to try this at home, you do not know how to do it.
My advice is: Start simple and use the given machine but later try to use your own Kali or Parrot. The reason is, if you get a job, you have to know more about troubleshooting and the installation of these tools.
THB Academy works like this: Read the material, get the first impression, and now start the machine and do it again with hands-on. Starting an instance takes a couple of seconds.
Start an instance
Read everything including the Request and Response section. At the end of this section is machine and you start it. The machine at the end is inconvenient, but change a setting at the bottom and the machine runs in a different and new window. Now you can work side by side.
Set up BurpSuite
The lab description tells you to find the "Burp Suite" button, but the machines does not have a button. This is okay, try be flexible and open Burp Suite via "Applications" (top, left side) -> Pentesting -> most used -> BurpSuite. If it is not there, it is under "Web Application Analysis". Sometimes you get "errors" or you need to accept rules.
The lab description tells you to find the "Burp Suite" button, but the machines does not have a button. This is okay, try be flexible and open Burp Suite via "Applications" (top, left side) -> Pentesting -> most used -> BurpSuite. If it is not there, it is under "Web Application Analysis". Sometimes you get "errors" or you need to accept rules.
|
|
This is okay, just try. In Cybersecurity everything is constantly changing. Some tools work today, but maybe not tomorrow. All guides and labs have this problem.
It is not your machine and if you do something wrong, start over. Start a new temporary project, click Next and start Burp Suite.
It is not your machine and if you do something wrong, start over. Start a new temporary project, click Next and start Burp Suite.
|
|
Set up Firefox
HackTheBox works sometimes weird, and does not allow internet connection. Before you move on, open Firefox and browse to a website. You might get a warning "Unsecure website". Accept the risk.
You need Firefox to route the traffic to BurpSuite. Start Firefox (has a button) and we are interested in the fox icon. This is a preinstalled tool called: FoxyProxy.
HackTheBox works sometimes weird, and does not allow internet connection. Before you move on, open Firefox and browse to a website. You might get a warning "Unsecure website". Accept the risk.
You need Firefox to route the traffic to BurpSuite. Start Firefox (has a button) and we are interested in the fox icon. This is a preinstalled tool called: FoxyProxy.
Again, if you want to follow the guide, you miss something. FoxyProxy is not configured and you have to do it without a hint.
Click on the icon for FoxyProxy and select "Options". A new window pops up and you can add a new setting.
Click on the icon for FoxyProxy and select "Options". A new window pops up and you can add a new setting.
|
|
Where do we find the right setting? Open BurpSuite and navigate to Proxy -> Options. Fill in the needed information. It should be:
A name: BurpSuite
The type:http
The IP address:127.0.0.1
Port:8080
Save the setting and we are done with this part. Now, we can follow the official guide. We have a "Turn Off" and a green "BurpSuite" option.
A name: BurpSuite
The type:http
The IP address:127.0.0.1
Port:8080
Save the setting and we are done with this part. Now, we can follow the official guide. We have a "Turn Off" and a green "BurpSuite" option.
|
|
Switch the setting to "BurpSuite" and follow the lab. You should see one thing, colors are different and your machine has a nicer look. This is because the guide is using an older version. This is for this lab not a problem.
|
|
What is somewhat annoying? Firefox is chatty and sends every second a request to http://detectportal....
You have to Forward or Drop all of these unwanted requests. They are annoying, because Firefox sends this request every 2 or 3 seconds and cleaning this area is simply not possible.
What is not working?
You have to Forward or Drop all of these unwanted requests. They are annoying, because Firefox sends this request every 2 or 3 seconds and cleaning this area is simply not possible.
What is not working?
The exercise does not give us this information and it is a guess. We can open a Mate-terminal (Menue -> System Tools), run nmap and see if we have a webserver running on our machine. You need an IP for this. You can use the
ip a
command or you see it on the top of your machine. Now, we can try to follow the lab.
ip a
command or you see it on the top of your machine. Now, we can try to follow the lab.
|
|
The browser will not do anything, because BurpSuite intercepts the traffic. We forward all the traffic until we see your request.
Expect a lot of clicks (50 or even much more), because every second, you get a "wrong" request. After a lot of clicks, you see something like this:
Expect a lot of clicks (50 or even much more), because every second, you get a "wrong" request. After a lot of clicks, you see something like this:
© 2021. This work is licensed under a CC BY-SA 4.0 license