Hack The Box — TwoMillion Write-Up
TL;DR The HackTheBox machine “TwoMillion” (released to celebrate 2 million users on the platform) is an easy Linux box involving web API enumeration and abuse. Initial access is gained by solving ...
0xr0hn
Hack The Box — Nibbles
TL;DR The HackTheBox machine “Nibbles” is an easy Linux box featuring a vulnerable Nibbleblog CMS (version 4.0.3) on an Apache web server. Initial access is gained by exploiting a directory traver...
Hack The Box — Solarlab
TL;DR The HackTheBox machine “SolarLab” is a medium-difficulty Windows box featuring a vulnerable ReportLab PDF generation system and an Openfire server with an authentication bypass vulnerability...
Hack The Box — Usage
TL;DR The HackTheBox machine “Usage” is an easy Linux box featuring a Laravel-based web application vulnerable to SQL injection, allowing extraction of user credentials. Initial access is gained b...
Hack The Box — Mailing
TL;DR The HackTheBox machine “Mailing” is an easy Windows box featuring an hMailServer email setup vulnerable to Local File Inclusion (LFI) and CVE-2024-21413. Initial access is gained by exploiti...
Hack The Box — Perfection
TL;DR The HackTheBox machine “Perfection” is an easy Linux box featuring a Ruby-based web application vulnerable to Server-Side Template Injection (SSTI). Initial access is gained by exploiting SS...
Hack The Box — Headless
TL;DR The HackTheBox machine “Headless” is an easy Linux box featuring a Flask-based web application vulnerable to Cross-Site Scripting (XSS) and insecure cookie handling. Initial access is gained...
Hack The Box — Crafty
TL;DR The HackTheBox machine “Crafty” is an easy Windows box featuring a Minecraft server vulnerable to Log4Shell (CVE-2021-44228). Initial access is gained by enumerating the Minecraft server on ...
Hack The Box — Devvortex
TL;DR The HackTheBox machine “Devvortex” is an easy Linux box featuring a Joomla CMS vulnerable to CVE-2023-23752, an unauthenticated information disclosure flaw. Initial access is gained by enume...