THM - Crylo

A writeup for the room Crylo on TryHackMe

Learn about the CryptoJS library and JavaScript-based client-side encryption and decryption.

Crylo

Task 1 - Enumeration

How many ports are open?

After starting the machine, we can do a scan with nmap to find the first answer.

nmap -sS -p- -v MACHINE_IP

What is the 403/forbidden web page?

Look at the website in the browser and check the source code.

All available pages return a 404 error.

Nothing seems to be interesting, so we can try using gobuster to enumerate possible subfolders.

It is important to set the -s flag to get also the results with status code 403.

gobuster dir -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt \
  -x php,txt,html,css,js -q -s "200,403" -u WEBSITE_URL