Hackxor: 1 ~ VulnHub

Back

About Release
| Download
| Description
| File information
| Virtual Machine
| Networking
| Screenshot(s)
| Walkthrough(s)

Hackxor: 1

About Release

Name: Hackxor: 1
Date release: 14 Oct 2012
Author: Albinowax
Series: Hackxor
Web page: http://hackxor.sourceforge.net/cgi-bin/index.pl

Download

Please remember that VulnHub is a free community resource so we are unable to check the machines that are provided to us. Before you download, please read our FAQs sections dealing with the dangers of running unknown VMs and our suggestions for “protecting yourself and your network. If you understand the risks, please download!

hackxor1.7z (Size: 587 MB)
Download: http://sourceforge.net/projects/hackxor/files/hackxor1.7z/download
Download (Mirror): https://download.vulnhub.com/hackxor/hackxor1.7z

hackxor11.7z (Size: 611 MB)
Download: http://sourceforge.net/projects/hackxor/files/hackxor11.7z/download
Download (Mirror): https://download.vulnhub.com/hackxor/hackxor11.7z

hackxorSource.7z (Size: 8.5 MB)
Download: http://sourceforge.net/projects/hackxor/files/hackxorSource.7z/download
Download (Mirror): https://download.vulnhub.com/hackxor/hackxorSource.7z

Description

Back to the Top

About hackxor

Hackxor is a webapp hacking game where players must locate and exploit vulnerabilities to progress through the story. Think WebGoat but with a plot and a focus on realism&difficulty. Contains XSS, CSRF, SQLi, ReDoS, DOR, command injection, etc

Features:

Client attack simulation using HtmlUnit; no alert('xss') here.
Smooth difficulty gradient from moderately easy to fiendishly tricky.
Realistic vulnerabilities modelled from Google, Mozilla, etc (No rot13!)
Open ended play; progress by any means possible.

Download & install instructions

Download the full version of hackxor (700mb)
Install VMWare Player (This involves creating a free account with vmware)
Extract hackxor1.7z, run the image using VMware player.
Work out what the IP of hackxor is ((try 172.16.93.129)|| logging into the VM with username:root pass:hackxor and typing ifconfig)
Configure your hosts file (/etc/hosts on linux) to redirect the following domains to the IP of hackxor: wraithmail, wraithbox, cloaknet, GGHB, hub71, utrack.
Browse to http://wraithmail:8080 and login with username:algo password:smurf

If you can't edit the hosts file for some reason, you could use the 'Override hostname resolution' option in Burp proxy

Troubleshooting the installation:

If http://wraithmail:8080 loads everything is probably working.
First: Try 'nmap wraithmail' in a shell to see if port 8080 is open. If it is open, contact me! Otherwise:
Second: Try nmap . If that succeeds, fix your hosts file. Otherwise:
Third: If you really can't get any network contact with the VM, check the VM settings in the VM manager
(this does not involve logging into the virtual machine). Make sure it is set to NAT. If that doesn't fix it:
Fourth: Try changing the VM network setting to 'Bridged'. This will mean other people on the LAN can access it.
Fifth: If all else fails, contact me on twitter.

The scene

You play a professional blackhat hacker hired to track down another hacker by any means possible. Start by checking your email on wraithmail, and see how far down the rabbit hole you can get. The key websites in this game are http://wraithmail:8080 http://cloaknet:8080 http://gghb:8080 and http://hub71:8080 so if you don't feel like tracking down your target you may hack them in any order. Each website will be properly introduced through the plot.