You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
> You can highlight important information in your articles or docs using different types of callouts (also known as admonitions – or alerts, as used in [the Hugo docs](https://gohugo.io/render-hooks/blockquotes/#alerts)).
124
124
125
-
For compatibility with HTML and Markdown in both content and layout files, we use a mix of shortcodes and partials to display blockquote alerts. Shortcodes on their own don't work in layout files, so you'll want to call a partial in layout files but use a shortcode (that calls the partial) in Markdown and HTML content files.
125
+
For compatibility with both content and layout files, we use a mix of shortcodes and partials to display blockquote alerts. Partials work in layout, but not content files. Shortcodes work in content, but not layout files. So you'll want to call the partial in layout files but use the shortcode (it calls the partial) in content files.
126
126
127
127
The partial is at `site/layouts/partials/blockquote-alert.html`, and the shortcode is at `site/layouts/shortcodes/blockquote-alert.html`.
128
128
129
-
There are five alert types. You can use these directly in Markdown and HTML cotent files. Omit the `title` parameter to keep the alert type as the default title (for example, a note alert will have "Note" as its title):
129
+
There are five alert types as shown in the examples below. Omit the `title` parameter to keep the alert type as the default title (for example, a note alert will have "Note" as its title). The descriptions for the alert types are borrowed from the Hugo docs:
You can include both simple string content, as shown above, and complex nested content with multiple paragraphs and HTML elements:
163
+
For layout files, you can call the partial as shown in the examples below. Just like in the shortcode examples, any string passed into the `content` parameter is interpreted as markdown. Use `html` instead `to pass in HTML. Again, the title parameter is optional and will default to the alert type:
164
+
165
+
```
166
+
# Partials in layout files
167
+
168
+
{{/* These are interpreted as Markdown */}}
169
+
{{ partial "blockquote-alert.html" (dict
170
+
"type" "note"
171
+
"title" "Optional custom title"
172
+
"content" "Useful information that users should know, even when skimming content."
173
+
) }}
174
+
175
+
{{ partial "blockquote-alert.html" (dict
176
+
"type" "tip"
177
+
"title" "Optional custom title"
178
+
"content" "Helpful advice for doing things better or more easily."
179
+
) }}
180
+
181
+
{{ partial "blockquote-alert.html" (dict
182
+
"type" "important"
183
+
"title" "Optional custom title"
184
+
"content" "Key information users need to know to achieve their goal."
185
+
) }}
186
+
187
+
{{ partial "blockquote-alert.html" (dict
188
+
"type" "warning"
189
+
"title" "Optional custom title"
190
+
"content" "Urgent info that needs immediate user attention to avoid problems."
191
+
) }}
192
+
193
+
{{ partial "blockquote-alert.html" (dict
194
+
"type" "caution"
195
+
"title" "Optional custom title"
196
+
"content" "Advises about risks or negative outcomes."
197
+
) }}
198
+
199
+
These are also valid:
200
+
201
+
{{ $alertContent := `This is a tip with **bold text** and _italic_ text.
202
+
203
+
This is a second paragraph in the same alert.
204
+
205
+
- List item 1
206
+
- List item 2
207
+
`}}
208
+
209
+
{{ partial "blockquote-alert.html" (dict
210
+
"type" "tip"
211
+
"title" "Optional custom title"
212
+
"content" $alertContent
213
+
) }}
214
+
215
+
216
+
{{ $alertContent := add
217
+
"This is a tip with **bold text** and _italic_ text.\n\n"
218
+
"This is a second paragraph in the same alert.\n"
219
+
"- List item 1\n"
220
+
"- List item 2\n\n"
221
+
"`Here's some text in backticks.`"
222
+
}}
223
+
224
+
{{ partial "blockquote-alert.html" (dict
225
+
"type" "tip"
226
+
"title" "Optional custom title"
227
+
"content" $alertContent
228
+
) }}
229
+
```
162
230
163
-
Shortcode:
231
+
You can include simple string content, as shown above, or complex nested content with multiple paragraphs and HTML elements:
{{ $alertContent := `This is a tip with **bold text** and _italic_ text.
262
+
263
+
This is a second paragraph in the same alert.
264
+
265
+
- List item 1
266
+
- List item 2
267
+
`}}
204
268
205
-
**In Other Partials:**
206
269
207
-
```go-html-template
208
-
{{ define "partials/footer-notice.html" }}
209
-
{{ partial "blockquote-alert" (dict
210
-
"type" "important"
211
-
"title" "Subscribe"
212
-
"content" "<p>Want to stay updated? <a href='/subscribe'>Join our newsletter</a>.</p>"
213
-
) }}
214
-
{{ end }}
215
-
```
270
+
{{ $alertContent := add
271
+
"This is a tip with **bold text** and _italic_ text.\n\n"
272
+
"This is a second paragraph in the same alert.\n"
273
+
"- List item 1\n"
274
+
"- List item 2\n\n"
275
+
"`Here's some text in backticks.`"
276
+
}}
216
277
217
278
**NOTE:**
218
279
219
-
You'll want to handle line breaks properly within the HTML content string when working with complex content. For example, the following will throw a parse error (`html: overlay: parse failed unterminated quoted string in action`):
280
+
You'll want to handle line breaks properly within the content string in partials when working with complex content. For example, the following will throw a parse error (`html: overlay: parse failed unterminated quoted string in action`):
220
281
221
282
```
222
283
{{ partial "blockquote-alert" (dict
@@ -227,19 +288,21 @@ You'll want to handle line breaks properly within the HTML content string when w
227
288
) }}
228
289
```
229
290
230
-
To fix this, you can:
291
+
To fix this, use either of these options:
231
292
232
293
- Keep everything on a single line
233
294
- Use string concatenation (whether in a variable or directly)
234
295
235
296
```
297
+
<!-- Option #1: Keep everything on a single line -->
236
298
{{ partial "blockquote-alert" (dict
237
299
"type" "caution"
238
300
"title" "Be Careful!"
239
301
"content" "<p>This is a <strong>caution</strong> message.</p><p>It has multiple paragraphs.</p>"
240
302
) }}
241
303
242
304
---------------
305
+
<!-- Option #2: Use string concatenation (whether in a variable or directly) -->
243
306
244
307
{{ $alertContent := add
245
308
"<p>This is a <strong>caution</strong> message.</p>"
@@ -251,7 +314,62 @@ To fix this, you can:
251
314
"title" "Be Careful!"
252
315
"content" $alertContent
253
316
) }}
254
-
```
317
+
318
+
This is a tip with **bold text** and _italic_ text.
For controlling what HTML is rendered, you need to work with the site templates. In the directory, `site/layouts/`, you'll find a number of HTML files with various template tags. The first file to check out is `site/layouts/_default/baseof.html` - this is the base layout Hugo uses to build your site that templates extend. Hugo has a lookup order for associating a content entry to a template. A single entry whose type is post (`type: post`), Hugo will look for a layout in `site/layouts/post/single.html`, and if that does not exist, it will fallback to `site/layouts/_default/single.html`.
> If you have any issues launching your browser from ZAP, see the following pages for help. ZAP uses add-ons to enhance its core features, including ones which provide webdrivers for interfacing with supported browsers. These are installed by default and expose some configurable options:
66
-
>
67
-
> 1.[How can I fix 'browser was not found'?](/faq/how-can-i-fix-browser-was-not-found/) - ZAP Docs (FAQ)
If you have any issues launching your browser from ZAP, see the following pages for help. ZAP uses add-ons to enhance its core features, including ones which provide webdrivers for interfacing with supported browsers. These are installed by default and expose some configurable options:
66
+
67
+
1.[How can I fix 'browser was not found'?](/faq/how-can-i-fix-browser-was-not-found/) - ZAP Docs (FAQ)
Assuming you’ve opened the lab in a browser configured to proxy through ZAP, let’s try to log in with a random password. We want to capture a POST request we can work with in ZAP. I’ll try “randompass”. We’re notified that this is an “Incorrect password”, which is expected:
72
73
@@ -96,8 +97,9 @@ After one minute, we can indeed make more login attempts. The idea is that if we
96
97
97
98
If we enter our own credentials, `wiener:peter`, on every third login attempt, the IP block never activates. Each successful login resets the counter tracking the number of failed login attempts. We can keep going until we’ve tried enough passwords from our wordlist to find the right one for Carlos' account.
98
99
99
-
> [!NOTE]
100
-
> This bypass — taking advantage of a logic flaw to reset the failure counter — enables us to brute-force Carlos’ password and successfully solve this lab. Although not the point of the lab, we can also wait out the IP block since we’re dealing with only a few credentials. This is covered in “Method 2: Wait Out the IP Block”.
100
+
{{< blockquote-alert type="note">}}
101
+
This bypass — taking advantage of a logic flaw to reset the failure counter — enables us to brute-force Carlos’ password and successfully solve this lab. Although not the point of the lab, we can also wait out the IP block since we’re dealing with only a few credentials. This is covered in “Method 2: Wait Out the IP Block”.
102
+
{{< /blockquote-alert >}}
101
103
102
104
What about changing our IP address? I used the [`X-Forwarded-For`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/X-Forwarded-For) header successfully in another lab. But the server here appears to block IPs based on the client's actual IP address (determined by the network layer rather than HTTP headers from the application layer), which makes sense in the context of rate-limiting. Rotating IP addresses via a proxy or VPN could work, but we won’t explore that here.
103
105
@@ -564,8 +566,9 @@ All functions, except the `log` function, are part of a required interface that
> Refer to the default templates for the interfaces required for each script type. You can find these in the Templates section of the Scripts tab. They include documentation comments describing each function and its parameters. You can also create new scripts from the templates.
569
+
{{< blockquote-alert type="note">}}
570
+
Refer to the default templates for the interfaces required for each script type. You can find these in the Templates section of the Scripts tab. They include documentation comments describing each function and its parameters. You can also create new scripts from the templates.
571
+
{{< /blockquote-alert >}}
569
572
570
573
You can save the file now. Also, check that the script is enabled, as disabled scripts won’t be available for selection when needed. If you missed the *Enable* checkbox earlier, you can right-click the filename in the *Scripts* tab and select *Enable Script(s)*.
571
574
@@ -583,10 +586,11 @@ After you open the *Add Payload* dialog, you can add the Payload Generator scrip
583
586
584
587
Save the payload and return to the main Fuzzer dialog. Then, run the Fuzzer with *Start Fuzzer*.
585
588
586
-
> [!IMPORTANT]
587
-
> You might notice that even though the payloads are generated correctly (as the logs in the script output panel show), the requests are sent in the wrong order. This causes an unexpected IP block early on. As a result, most of the requests are rejected with the message: `You have made too many incorrect login attempts. Please try again in 1 minute(s).`
588
-
>
589
-
> This is due to the Fuzzer’s concurrency settings. You can enable sequential execution by setting the number of execution threads to 1. However, this slows down the Fuzzer a great deal. An alternative is to throttle requests with a small delay of 100–200 milliseconds. See [Options Fuzzer screen](/docs/desktop/addons/fuzzer/options/) for more detail.
589
+
{{< blockquote-alert type="important">}}
590
+
You might notice that even though the payloads are generated correctly (as the logs in the script output panel show), the requests are sent in the wrong order. This causes an unexpected IP block early on. As a result, most of the requests are rejected with the message: `You have made too many incorrect login attempts. Please try again in 1 minute(s).`
591
+
592
+
This is due to the Fuzzer’s concurrency settings. You can enable sequential execution by setting the number of execution threads to 1. However, this slows down the Fuzzer a great deal. An alternative is to throttle requests with a small delay of 100–200 milliseconds. See [Options Fuzzer screen](/docs/desktop/addons/fuzzer/options/) for more detail.
593
+
{{< /blockquote-alert >}}
590
594
591
595
You can skip over the next section and head to [Have Username, Got Password](#have-username-got-password).
592
596
@@ -715,8 +719,9 @@ You can optionally move the script to the top of the processor list. Then, run t
715
719
716
720
Once the Fuzzer is done, we can inspect the results. We’re looking for indications of a successful login. So, we’ll sort the results in descending order using the status code column (simply “*Code”* in the UI).
717
721
718
-
> [!NOTE]
719
-
> Both of these solutions are valid. As you might have noticed if you’ve solved a lab more than once, different lab instances can have different password solutions. So, you could see different passwords than shown below.
722
+
{{< blockquote-alert type="note">}}
723
+
Both of these solutions are valid. As you might have noticed if you’ve solved a lab more than once, different lab instances can have different password solutions. So, you could see different passwords than shown below.
724
+
{{< /blockquote-alert >}}
720
725
721
726
### Method 1: Interleave Wordlists With Valid Credentials
0 commit comments