> For the complete documentation index, see [llms.txt](https://writeups.adityadindi.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://writeups.adityadindi.com/tryhackme/walkthroughs-easy/avengers-blog.md).

# Avengers Blog

![](/files/-Md-Vrkmma_MpxpporGe)

## Cookies

![](/files/-Md-WZDm2C38QA8nNY2H)

Lets visit the webpage

![](/files/-Md-WkS_MW9A9PY6bmTr)

Lets look at the Cookies (Ctrl + Shift + i) in the Storage tab'

![](/files/-Md-WwkiAQqP10SmAmYz)

We have the flag

## HTTP Headers

![](/files/-Md-X2pe-wPaiYbWq9Um)

Lets go to the Network tab and hit reload and select the option to only look at HTTP requests

![](/files/-Md-XVzEANJQpl6yyk-T)

We have the second flag

## Enumeration and FTP

![](/files/-Md-XmgRbMxn9wMUcU4r)

Lets run a nmap scan to find open ports and then login into FTP with the given credentials.

![](/files/-Md-Y7aChe0Df7KNHBP4)

![](/files/-Md-Y9ULczcChahrsGOO)

Lets look at the files on the FTP server, 

![](/files/-Md-YKiQ4hzigS6wsRbG)

We have a directory and the flag in the directory, so transfer the file onto our machine and read the file to get the third flag.

## Gobuster 

![](/files/-Md-YYcHBDhxEOlCTyUq)

Lets run gobuster to find hidden files and directories

![](/files/-Md-Z-BRDwYruQjz-II5)

The /portal has a login page, so that the answer for this task

![](/files/-Md-Z9KSnYAh3s6c2pTG)

## SQL Injection

![](/files/-Md-ZGXx--k3oxWGFIdj)

Lets capture the request using Burp and send it to repeater

![](/files/-Md-_Qv6-7DY_LHDnGMy)

Now lets use SQL Injection to login as admin

![](/files/-Md-_lP3fi6jyYH_8pW9)

![](/files/-Md-_vM5JQmzsLaE0Ilm)

Its says found, now lets send it as a real request in the proxy tab. 

![](/files/-Md-a0EKLMdFcZTmnjSn)

We are logged in. Looking at the source code, there are 223 lines being used, so that is the answer to the question in this task.

![](/files/-Md-aRg9nf9aT1WPLO71)

## Remote Code Execution and Linux

![](/files/-Md-a_J8nhOSRdqjUbTC)

We cannot read the file with the **cat** command, so lets use the **tac** command

![](/files/-Md-b111jn38sRMW6yYB)