Web Hacking

This post documents my process for solving the Neonify box on Hack The Box. This challenge revolves around a Ruby application vulnerable to Server-Side Template Injection (SSTI) via a regex newline bypass. Challenge Description It’s time for a shiny new reveal for the first-ever text neonifier. Come test out our brand new website and make any text glow like a lo-fi neon tube! Solution After looking at the source code, I noticed it was a Ruby application and suspected some kind of command injection. I didn’t immediately see the path, so I referred to a writeup and discovered that the challenge is about “ERB SSTI via newline regex bypass.” There’s very little public writeup info on this exact method, which made it a great learning opportunity. ...

This post documents my process for solving the Toxic box on Hack The Box. This box is all about PHP insecure deserialization, exploiting LFI, and using log poisoning to achieve remote code execution. Synopsis PHP insecure deserialization to LFI that abuses log poisoning for RCE. Learning References: https://ianpeter.medium.com/exploiting-log-poisoning-through-lfi-and-serialization-in-php-e039e7b126ad The official writeup I wasn’t sure what to do at first, so I checked the writeup after struggling for a while. Challenge Analysis & Source Code Review The web page didn’t reveal much, but looking at the source code, you see: ...

This post documents my process for solving the LoveTok box on Hack The Box. The challenge involves analyzing PHP source code, understanding the misuse of addslashes, and exploiting command injection through the eval function. Description True love is tough, and even harder to find. Once the sun has set, the lights close and the bell has rung… you find yourself licking your wounds and contemplating human existence. You wish to have somebody important in your life to share the experiences that come with it, the good and the bad. This is why we made LoveTok, the brand new service that accurately predicts in the threshold of milliseconds when love will come knockin’ (at your door). Come and check it out, but don’t try to cheat love because love cheats back. ...

This post documents my process for solving the Phonebook box on Hack The Box. The box focuses on LDAP injection and brute-forcing credentials using knowledge of LDAP search/filter syntax. Solve I didn’t find any obvious attack vectors except for a DOM-based HTML injection. After checking a writeup, I learned the challenge was about LDAP injection—a topic I had little prior experience with. What is LDAP Injection? According to PayloadAllTheThings, LDAP Injection is a vulnerability that occurs when user-supplied input is used to construct LDAP queries without proper sanitization or escaping. ...

This post documents my process for solving the Pandora box on Hack The Box. The challenge focuses on recon, SNMP enumeration, port forwarding, SQLi on an internal service, and a series of lateral movement and privilege escalation steps. Recon Initial port scan: ports=$(nmap -p- --min-rate=1000 -T4 10.10.11.136 | grep ^[0-9] | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//) nmap -p$ports -sC -sV 10.10.11.136 Open ports: 22 (SSH) 80 (HTTP, Apache, Ubuntu) Enumerated with UDP scan (-sU): ...

This post documents my process for solving the Validation box on Hack The Box. This challenge centers on SQL injection, writing a web shell via SQLi, and privilege escalation via password reuse. Recon Started with full port scan: ports=$(nmap -p- --min-rate=1000 -T4 <IP> | grep ^[0-9] | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//) echo $ports # 22,80,4566,5000,5001,5002,5003,5004,5005,5006,5007,5008,8080 nmap -p$ports -sC -sV 10.10.11.116 Main open ports: 22 (SSH), 80 (Apache), 4566 (nginx), 8080 (nginx). ...

This post documents my process for solving the Writeup box on Hack The Box. The machine revolves around web enumeration, CMS exploitation, SQLi, hash cracking, and privilege escalation via PATH hijacking. Recon Target: 10.10.10.138 nmap -sC -sV 10.10.10.138 Results: 22/tcp (SSH) OpenSSH 9.2p1 Debian 80/tcp (HTTP) Apache httpd 2.4.25 (Debian) robots.txt has a disallowed entry: /writeup/ Site uses CMS Made Simple, version 2.2.9.1 CMS Exploitation Accessed /writeup and /writeup/doc/CHANGELOG.txt to confirm CMS version. ...

This post documents my process for solving the Help box on Hack The Box. This box involves GraphQL enumeration, credential dumping, hash cracking, and classic web application enumeration and exploitation. Recon Initial nmap scan: nmap -sC -sV -oA nmap/help <IP> Found GraphQL running on port 3000. GraphQL Enumeration Referred to PayloadsAllTheThings - GraphQL Injection to start enumeration. Discovered GraphQL types via introspection: http://10.10.10.121:3000/graphql?query={__schema{types{name}}} Full schema dump and queries revealed a user type with username and password fields. ...

This is a challenge old-02 from webhacking.kr. I was stuck trying to understand how people were discovering this SQLi vulnerability through a cookie, as no blog posts explained why the attack was effective. This wasn’t a typical SQLi challenge that I’m used to, so I really wanted to know why it worked the way it did. The goal of this challenge is to figure out the password used for the admin.php page (mentioned in the HTML comment). ...