HTB OnlyHacks Walkthrough

I started up the target and connected to the HTB VPN. I then, opened up a new tab and pasted in the provided URI.

A web application opened up with a login page along with a signup prompt. I checked the source for any commented-out credentials or any secrets at all — did not find any, so moved to the /register endpoint.

In the register page we are asked for a lot of info like username, password, profile picture, email, age, bio and our preference.

I filled up the profile with expected data to analyze the application behaviour first.

After registering a new account, cards of different profiles show up.

Upon source code inspection, it turns out to be static cards instead of dynamically generated. I then, tried for common endpoints like sitemap.xml, robots.txt, security.txt — no luck.

So I decided to run a fuzzer to check if any common endpoints are available. The results did not reveal any unknown endpoints. I decided to change my approach and analyze the application behaviour further.

After liking all the profiles, a match appears in /chat endpoint. On opening the chat, I saw a parameter "rid=6"

The rid is being used to open particular chats.

I tried with a few other rid values, since it was a integer and likely incremental and

for the rid value of 3, found out the flag.

Submitted the flag and pwned the room successfully.

The primary vulnerability here was that the application was not checking whether the user has proper authorization to view a particular rid/chat.

To prevent this, we have to implement proper access controls and authorization checks at the backend. We should also preferrably use UUID/GUID identifiers for reference chats instead of incremental integer UID which can be easily guessed or predicted.