No FA
Web Recon
The entry point of the application is a login portal. 
Information Gathering & Credential Recovery
The challenge provides a database file (users.db), suggesting an offline credential recovery and cracking phase is required
Using the file command, we confirmed the database is an SQLite 3.x file
1
2
❯ file users.db
users.db: SQLite 3.x database, last written using SQLite version 3049001, file counter 2, database pages 4, cookie 0x1, schema 4, UTF-8, version-valid-for 2
After exploring the users table, we identified a list of usernames and their corresponding hashes. 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
john.doe:599a4410e2af69d1585f16d82d4b5f0abf3ad09fa42b9d55d7b7a50671ccf8c1
jane.smith:81c68634d1b211e0d5632839f7efc8601c743f1ef0c94da8220e26ab221efff1
robert.jones:aaf120fcb16e20e2d18e63e668e060b5e4a52c5e0b3f038777365fe87ca2ccdb
emily.brown:9e85668a071a595fe9222725bfb591cdaa0d880e3a7c7de1d9ddd3d4b7d08772
admin:c20fa16907343eef642d10f0bdb81bf629e6aaf6c906f26eabda079ca9e5ab67
michael.davis:576454d8921440f30609200a7f79073ec5b69ee284f27bbb860620d56416ad94
linda.wilson:082a6006d9c87749adff6be260461171b508744a90a45f75abe78d92995485c5
david.garcia:faa32a09d4798d21486344a140fd0977cbec33fd5b045bca83c04efb364c49d9
jennifer.rodriguez:c1488b6d9ed8352a64f979506583f33d80aa4119190f7892bc481e8984c880d0
christopher.williams:0bf3a14c03e9c7034b9588a69f828840fd32bd739c37b613f41c4aecee26e277
angela.martinez:e64b5893827166e4568af8ece105d8c0839772ae10fba3c11e77b5fb3c0ef0c6
kevin.anderson:8bac48021ebd453dbd876d43fa28c8e383fc16176fc8b12fa474b01eb9fa4df5
melissa.thomas:564c89c28d93e8485b76a41deca21ab28e60a32c506e479b925f4643722e9f83
brian.jackson:7fccba2f216750414443626058128539ef5a8859f7cb20da2b22d8d787ec6fc2
stephanie.white:64acea3bdefef67d65e6a36ee66ac66e85d39931639ea926d1fc98fedd28905b
eric.harris:b9590eaeaa25401398ebd4b98e10182f4e265f396f23a11eb8fdb18d66a1685c
michelle.martin:9b68124e23f3bb700682d28d1d750bec95794a193097b59526ef038f810cb34c
patrick.thompson:1549f62e486c006cbbacee5947c3f6815a0c5f3ef54c80f1f0b17c2ae9da5866
nicole.garrett:5647517c88d64c95170fdb734dc22ba45e284f219d1266eb14f4d9dd7a099ce3
joseph.cole:49a57175de704a0ec2a006746d20d375814581bb35552ce0a0b13683426fd232
Hash ID indicate a SHA-256 hashing algorithm. 
We utilized a wordlist attack (rockyou.txt) against the recovered hashes:
1
2
3
4
5
6
7
8
9
10
11
❯ john --format=raw-sha256 --wordlist=~/Arsenal/Wordlist/rockyou.txt hashes
Using default input encoding: UTF-8
Loaded 20 password hashes with no different salts (Raw-SHA256 [SHA256 128/128 AVX 4x])
Warning: poor OpenMP scalability for this hash type, consider --fork=12
Will run 12 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
apple123 (john.doe)
apple@123 (admin)
2g 0:00:00:00 DONE (2026-03-20 02:18) 2.469g/s 17707Kp/s 17707Kc/s 321410KC/s 01.juli.92..*7¡Vamos!
Use the "--show --format=Raw-SHA256" options to display all of the cracked passwords reliably
Session completed
Recovered Credentials:
1
2
3
❯ john --show --format=raw-sha256 hashes
john.doe:apple123
admin:apple@123
Source Code Analysis (OTP Vulnerability)
Attempting to log in as admin triggers a second-factor authentication (2FA) prompt. 
Analyzing the source code reveals that the One-Time Password (OTP) is a purely numeric, 4-digit code (ranging from 1000 to 9999). 
Exploitation (2FA Brute Force)
To bypass the 2FA, we performed a high-concurrency brute-force attack on the OTP input using Burp Suite Intruder: 
Capture: Intercepted the OTP submission request with Burp Proxy.
Payloads: Set the payload type to Numbers (1000 to 9999, step 1).
Optimization: Configured a Custom Resource Pool with 70 concurrent requests to maximize speed. 
Identification: Monitored the results for an HTTP 302 (Found) status code, which indicates a successful redirect to the dashboard.
Once the correct OTP was identified by the fuzzer, we used the “Request in Browser” feature to finalize the session. The administrative dashboard revealed the flag. 