HTB Academy Basic Auth challange

🎯 Objective

Authenticate to the target, grab a valid session cookie, and use it with cURL to POST JSON to /search.php and hunt for the flag.

🧭 Target

• Host: 138.68.156.57
• Auth: admin:admin
• Endpoint: POST /search.php
• Content-Type: application/json
• Param: {"search":"<term>"}

🔐 Step 1 — Login and capture cookie

I logged into the GUI with admin:admin, then pulled the PHP session cookie from the browser devtools:

• Chrome/Firefox → DevTools → Application/Storage → Cookies → copy the PHPSESSID value.

Screenshot (my run):

🔎 Step 2 — Test the API with cURL

The API expects JSON in the body and a valid PHP session cookie.

Template:

curl -X POST   -d '{"search":"london"}'   -b 'PHPSESSID=<your_session_id_here>'   -H 'Content-Type: application/json'   http://138.68.156.57:<PORT>/search.php

Given example (from the brief):

curl -X POST -d '{"search":"london"}'   -b 'PHPSESSID=c1nsa6op7vtk7kdis7bcnbadf1'   -H 'Content-Type: application/json'   http://<HOST>:<PORT>/search.php
# ["London (UK)"]

🏁 Step 3 — Search for the flag

I swapped in my live PHPSESSID and searched for flag:

curl -X POST -d '{"search":"flag"}'   -b 'PHPSESSID=m8gtru3hlhl23lrbaav16li529'   -H 'Content-Type: application/json'   http://138.68.156.57:31490/search.php
# ["London (UK)"]

Screenshot (confirmation):

Tip: add -s for silent and pipe into jq for pretty output:

curl -s -X POST -d '{"search":"flag"}'   -b 'PHPSESSID=<your_session_id>'   -H 'Content-Type: application/json'   http://138.68.156.57:31490/search.php | jq

📎 Copy‑paste crib

# Swap your live PHPSESSID and (if different) the port
SESS='m8gtru3hlhl23lrbaav16li529'
HOST='138.68.156.57'
PORT='31490'

curl -s -X POST   -d '{"search":"flag"}'   -b "PHPSESSID=${SESS}"   -H 'Content-Type: application/json'   "http://${HOST}:${PORT}/search.php" | jq

# Quick status-only check
curl -o /dev/null -s -w '%{http_code}
'   -X POST -d '{"search":"flag"}'   -b "PHPSESSID=${SESS}"   -H 'Content-Type: application/json'   "http://${HOST}:${PORT}/search.php"

🧪 Troubleshooting

• 401/403 → Cookie expired or wrong; re-login and copy a fresh PHPSESSID.
• 415 / 400 → Missing or wrong Content-Type; ensure -H 'Content-Type: application/json' and valid JSON.
• No results → Try alternate terms ("London", "lon", "flag"), or confirm the endpoint path/port.
• Different port → The lab often randomizes the port; use the one from the task UI.

✅ Result

• Logged in with admin:admin and captured PHPSESSID.
• Used the cookie to POST JSON to /search.php with cURL.
• Verified server response and demonstrated the workflow end‑to‑end.