Introduction
CyberHeroes is a beginner-level TryHackMe room focused on breaking weak client-side authentication by inspecting exposed web logic. The goal is to find a way to log in using what the application itself reveals.
Room link: https://tryhackme.com/room/cyberheroes
Initial Reconnaissance
I started with a basic Nmap scan to understand what services were exposed on the target.
~$ nmap -sV 10.48.153.105
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.4 (Ubuntu Linux; protocol 2.0)
80/tcp open http Apache httpd 2.4.48 ((Ubuntu))
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
There are two services running:
• SSH on port 22 • HTTP on port 80
Web Exploitation
Since port 80 was open, I navigated to it directly in the browser.
The landing page turned out to be a simple index page with three tabs, including an About section and a Login page.
The login page displayed a familiar challenge message inviting me to prove my hacking skills. With no credentials available upfront, I checked the page source and came across the following JavaScript block:
This is where everything clicked. The script validates the input by checking a hardcoded username and a reversed password string.
if (a.value=="h3ck3rBoi" & b.value==RevereString("54321@terceSrepuS"))
Reversing the string reveals the password as SuperSecret@12345. With that, the required credentials became clear.
Username
h3ck3rBoi
Password
SuperSecret@12345
Capturing the Flag
After logging in with the above credentials, the page returned the flag.
flag{edb0be532c540b1a150c3a7e85d2466e}
Conclusion
CyberHeroes was a short but clean room that reinforced a core lesson I keep coming back to: never ignore what the client side is doing. A simple look at exposed JavaScript was enough to break the authentication logic and reach the goal. No noise, no detours, just paying attention to what was already in plain sight.
Thanks for taking the time to read this walkthrough.