POP Restaurant is a PHP object injection challenge from Hack The Box. Rather than exploiting a running service blindly, this challenge provides the application source code, allowing us to review the code and identify a usable gadget chain. The vulnerability lies in the unsafe use of PHP’s unserialize() function on user-controlled data. Our goal is
Spookifier Challenge on HackTheBox Challenge Description There’s a new trend of an application that generates a spooky name for you. Users of that application later discovered that their real names were also magically changed, causing havoc in their life. Could you help bring down this application? Overview When I first looked at the challenge, I
Leak /etc/passwd to retrieve the flag Hack The BoxEdit descriptionapp.hackthebox.com Challenge Description Welcome to PDFy, the exciting challenge where you turn your favorite web pages into portable PDF documents! It’s your chance to capture, share, and preserve the best of the internet with precision and creativity. Join us and transform the way we save and cherish web
Hack The Box walkthrough with Node.js OTP brute-force script included Challenge Description SpeedNet is an ISP platform. Join our bug bounty to find vulnerabilities and retrieve the hidden flag. Test using the email service athttp://IP:PORT/emails/ Use: test@email.htb Initial Recon I began by exploring the application, registering a test account, and creating a visual map of the
Challenge Link: JinjaCare — HTB Challenge Description JinjaCare is a web application designed to manage COVID-19 vaccination records. It allows users to view their personal information, medical history, and generate digital vaccination certificates. Your task is to discover vulnerabilities in the system and extract the hidden flag. Recon and Initial Exploration Upon launching the instance, the home
Challenge Link Challenge Description Neovault is a trusted banking app for fund transfers and downloading transaction history. You’re invited to explore the app, find potential vulnerabilities, and uncover the hidden flag within. Initial Exploration After starting the instance and visiting the host, I landed on the NeoVault homepage. I began by clicking around and interacting