[{"_1":2,"_33":-5,"_34":-5},"loaderData",{"_3":4},"routes/challenges.$slug",{"_5":6},"challenge",{"_7":8,"_9":10,"_11":12,"_13":14,"_15":16,"_17":18,"_19":20,"_21":22,"_23":24,"_30":31},"slug","guardian","name","Guardian","category","Bash","description","SCENARIO A system monitoring service is running on this machine, quietly keeping an eye on temperatures and system load. It runs as root. You do not. You land as a regular user. The path to root is somewhere in how that service works and the privileges it carries. Find it. Credentials: user:user Infrastructure - Docker Container — HTTP on port 7681 Provided Files - None","descriptionHtml","

SCENARIO

A system monitoring service is running on this machine, quietly keeping an eye on temperatures and system load. It runs as root. You do not.

You land as a regular user. The path to root is somewhere in how that service works and the privileges it carries. Find it.

Credentials: user:user

Infrastructure

- Docker Container — HTTP on port 7681

Provided Files

- None

","labDetails","Prerequisites & Requirements Basic understanding of web applications and how HTTP requests work Familiarity with JWT tokens and how they are structured and verified Basic understanding of path traversal vulnerabilities and how file paths are resolved Understanding of SQL injection, including how unsanitized input reaches database queries Python with the JWT library for scripting and token generation What will you learn? How to identify and exploit Local File Disclosure vulnerabilities through insufficient input sanitization How to use a leaked secret key to forge JWT tokens with elevated privileges How second-order SQL injection works and why stored user input can be just as dangerous as direct injection How to chain multiple vulnerabilities together to bypass layered authentication and achieve privilege escalation Why validating tokens against the database does not fully protect an application when other weaknesses exist Tools Burp Suite for intercepting requests, observing application behavior, and submitting crafted payloads Python with the JWT library for generating forged tokens and scripting the full exploit chain Web Browser for interacting with the application and navigating its features","labDetailsHtml","

Prerequisites & Requirements

Basic understanding of web applications and how HTTP requests work
Familiarity with JWT tokens and how they are structured and verified
Basic understanding of path traversal vulnerabilities and how file paths are resolved
Understanding of SQL injection, including how unsanitized input reaches database queries
Python with the JWT library for scripting and token generation

What will you learn?

How to identify and exploit Local File Disclosure vulnerabilities through insufficient input sanitization
How to use a leaked secret key to forge JWT tokens with elevated privileges
How second-order SQL injection works and why stored user input can be just as dangerous as direct injection
How to chain multiple vulnerabilities together to bypass layered authentication and achieve privilege escalation
Why validating tokens against the database does not fully protect an application when other weaknesses exist

Tools

Burp Suite for intercepting requests, observing application behavior, and submitting crafted payloads
Python with the JWT library for generating forged tokens and scripting the full exploit chain
Web Browser for interacting with the application and navigating its features

","level","Hard","tags",[25,26,27,28,29],"Privilege Escalation","Suid","Environment Variables","Path Variable","Bash Pitfalls","jobPositions",[32],"Penetration Tester","actionData","errors"]

Guardian

Overview

SCENARIO

Infrastructure

Provided Files

Job Positions

Tags