#htb

Articles tagged with #htb

HackTheBox : JinjaCare
Summary JinjaCare is a Flask-based COVID-19 vaccination verification web app. The intended path chains wkhtmltopdf HTML/local-file injection (via the certificate-generation feature) to disclose the Fl
Jul 14, 20269 min read9
HackTheBox: NeoVault Challenge Writeup
Summary NeoVault is a small banking app (Next.js frontend + REST API) that lets users register, transfer funds, and download PDF statements. The API ships in two parallel versions, v1 and v2. v2 patch
Jul 13, 20268 min read25
HackTheBox: vulnEscape Writeup
Summary Escape is a Windows box that exposes only RDP (3389). The RDP session drops you into a locked-down kiosk account (KioskUser0) meant for a "Conference Display" app. The box is solved entirely t
Jul 2, 20267 min read8
HackTheBox: Reset Writeup
Summary Reset is a Linux box built around a chain of web application logic flaws and a legacy authentication misconfiguration. Initial access starts with a password reset endpoint that leaks the new a
Jul 1, 20269 min read50
HackTheBox: Sendai Writeup
Summary Sendai is a Windows Active Directory machine exposed with SMB guest access. RID brute-forcing reveals a full user list, and two accounts have expired passwords that can be reset with no knowle
Jun 29, 202610 min read12
HackTheBox: Sloink Writeup
Summary NFS shares exposed the target's home directory and PostgreSQL backups. The user's psql history contained an MD5 hash that cracked to service. SSH with that account drops you immediately (shell
Jun 28, 20267 min read2