SANS HHC 2016 - Part 4: My Gosh... It's Full of Holes - Scoping / Analytics (guest) / Dungeon
SANS Holiday Hack Challenge 2016 Part 4: My Gosh... It's Full of Holes 7) ONCE YOU GET APPROVAL OF GIVEN IN-SCOPE TARGET IP ADDRESSES FROM TOM HESSMAN AT THE NORTH POLE, ATTEMPT TO REMOTELY EXPLOIT EACH OF THE FOLLOWING TARGETS: The Mobile Analytics Server (via credentialed login access) The Dungeon Game The Debug Server The Banner Ad Server The Uncaught Exception Handler Server The Mobile Analytics Server (post authentication) Scoping and recon While looking into the SantaGram apk file, I found these URLs in the strings.xml file: · https://www.northpolewonderland.com · https://analytics.northpolewonderland.com/ · http://ads.northpolewonderland.com/ · http://dev.northpolewonderland.com/ · http://dungeon.n...