The complete portal
The supplier portal of Martello & Sons Hardware has more than one crack, but none is enough on its own: you have to chain them, each one gives you what you need for the next. Start from the target, get all the way to administration and grab the flag.
Lab 7 of 7 in the Web Exploitation path. If you get stuck you have 3 hints, from the vaguest to the most precise: they cost 0, 60 and 200 XP.
What you learn
Objectives complete themselves while you work in the terminal; each one is worth experience points:
- Map the target with nmap (100 XP)
- Find the forgotten development notes (200 XP)
- Find out which accounts exist (200 XP)
- Get into the portal with the initial password (250 XP)
Topics: web, chain, defense-in-depth.
Commands you will use
The terminal is simulated and understands about forty Linux commands. In this lab you will mostly need these:
nmap: discovers the live hosts of a network and the open ports of a machine, with services and versions. Defenders use it to compare the real network with the inventory.gobuster: automatically tries a list of folder and page names on a website, to find what no link shows.curl: makes HTTP requests from the terminal and shows the server’s raw answer, headers included.
The simulated environment
The target is an invented host on a simulated private network: you can only reach it from the game terminal.
The target exposes these services:
- SSH: encrypted remote command-line access; it is protected with keys instead of passwords and without direct root login.
- Web (HTTP): a web server with pages, APIs or admin panels: the most exposed part of almost every organisation.
The defensive lesson
Once the lab is solved, the write-up explains what went wrong and how to protect yourself:
None of these cracks opened the portal alone: the chain did. robots.txt acted as a map, the forgotten notes gave usernames and an initial password, the different error messages revealed which accounts exist, the password that was never changed opened the door, and the role stored in an editable cookie handed over administration. Defensive lesson: defence in depth. Every layer must be reinforced (no development files online, generic messages, initial passwords changed at first login with a limit on attempts, roles checked by the server), because breaking just one link is enough to stop the whole chain.
Before and after this lab
To unlock it you must have solved:
- Aurora — Web Breach (Web Exploitation, medium)
- Clues in the page code (Web Exploitation, medium)
- Error messages that talk too much (Web Exploitation, medium)
It is one of the final labs: no other lab requires it.
The Web Exploitation path
Web Exploitation brings the basics into the world of websites and web applications, where a huge share of real attacks happen. You explore invented sites with HTTP requests from the terminal and discover folders someone hoped to hide, cookies the server trusts too much, factory credentials never changed, comments forgotten in the page source and error messages that say too much. The lessons follow the OWASP Top 10 categories, such as Broken Access Control and authentication failures, and each one explains the fix.