Here is a description of penentration testing process. Extract login:password pairs and write in following format:
Creds: login:password

If no credentials were found, output NONE

Description to analyze:
page. Let's login with our credential.

The website displays modules from Hack The Box Academy, but there doesn't seem to be any
additional functionality available that we could exploit. Let's enumerate for hidden directories
and ﬁles. We will be using dirsearch, but feel free to use other directory brute force tools.
git clone https://github.com/NAME_1/dirsearch.git
cd dirsearch
pip3 install -r requirements.txt
python3 dirsearch.py -u http://academy.htb/

Dirsearch comes with its own wordlists which can be found in the db/ folder.

Dirsearch reveals a lots of PHP ﬁles of which admin.php is the most interesting. Browsing to
/admin reveals a login page. Attempting to login with our registered user fails. Let's try to

register a new account again, examine the request in Burp Suite and see if we can bypass the
login.
Documentation to help conﬁgure Burp Suite is available here. Let's enable intercept mode and
register a new user.

POST /register.php HTTP/1.1
Host: academy.htb
User-Agent: Mozilla/5.0 (X11; U
 Write your response with exactly 2 paragraphs, separated with the markdown divider: ***.
user