TRYHACKME: CYBERHEROES

Step 1: Port Scanning
Begin with a full port scan using Nmap to identify open services.

-sC -T4 -sV  -v 10.81.145.116 

we have ports 80 and 22 open

• Port 22: OpenSSH 8.2p1
• Port 80: Apache httpd 2.4.48 hosting a webpage titled CyberHeroes.

step 3: Directory Bruteforcing

I used Gobuster to check for hidden directories but found nothing special:

the assets directory looks interesting

gobuster dir -u http://10.81.145.116/ \ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt \ -t 50

Step 4: Lets visit the website hosted on port 80

lets visit the assets directory we found when scanning

Step 5: Navigating to login.

Step 7: Inspecting Page Source

I viewed the page source (Ctrl+U) and searched for “flag” (ctrl + F and type flag) to find any hidden clue

Step 2: Inspecting the Page & Cracking the Code
I opened up http://10.81.145.116 and saw a basic login page. To see what was happening under the hood, I hit Ctrl + U to view the page source.

Get Coolpeka’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Boom. Right there in the HTML was a custom JavaScript function called authenticate(). This is a classic rookie mistake: client-side authentication. Instead of checking the password safely on a server, the web app does it right in our browser.

Here is the breakdown of the logic:

1. The Username: The code checks if the username matches a hardcoded string:
   h3ck3rBoi
2. The Password Trick: The password check uses a custom function called RevereString to flip a string backward:
   RevereString("54321@terceSrepuS")

All we have to do is reverse that scrambled string manually to get the real password:

• Scrambled: 54321@terceSrepuS
• Unscrambled: SuperSecret@12345

echo "54321@terceSrepuS" | rev

Logging In

Now we have our golden keys:

• Username: h3ck3rBoi
• Password: SuperSecret@12345

I plugged these into the login fields, hit enter, and let the script fetch the flag!

Answer: flag{edb0be532c540b1a150c3a7e85d2466e}

The Hacker Mindset: Why Ctrl+U and why search for “flag”?

Let’s keep it real. If you’re new to this, you’re probably wondering: “Bro, how did you even know to check the source code and look for that specific word?”

It’s just hacker instinct. When you see a login page, the developer either checked the password safely on a server, or they got lazy and checked it right in your browser using JavaScript.

Before you start stressing yourself, burning data, or running heavy brute-force tools, you always check for the easiest path first. Pressing Ctrl + U is like checking under the doormat to see if the landlord left the keys there.

Once the code pops up, there’s too much text, so you use Ctrl + F to search for "flag." In these CTF rooms, the prize is always called a flag, and the website has to display it somewhere when you log in. Searching for it cuts out the noise and shows you exactly where the magic happens.

Turns out the keys were right under the mat! It took two seconds and saved us a whole lot of unneeded stress.