Hack The Box OnlyHacks Walkthrough

Challenge Scenario :

Dating and matching can be exciting especially during Valentine’s, but it’s important to stay vigilant for impostors. Can you help identify possible frauds?

Solution :

This challenge was pretty easy , nothing complicated overall .

First we visit the given IP address :

First thing i tried is basic auth bypass via SQLi but that didn’t work , so i moved to FUZZING the application for directories :

feroxbuster -u http://154.57.164.82:32598/

Both chat and matches return 500 and 401 , the rest redirects us back to the login page , let’s just create an account and browse the application further :

When creating the account , we see that we can’t modify any role or get admin rights by intercepting and modifying the request :

Once inside :

First let’s use every feature on the app then check Burp history to see which requests are made to the server :

Nothing interesting for now , let’s try to get a match and send a normal message to see if we get a different request :

Now if we check Burp :

We see that we send a POST request with our ID parameter when we write a normal message :

Then we get another GET request , which shows us the conversation , and it contains the same RID , let’s try to modify the rid and hope we get the conversation of a different user instead :

For this i used FFUF , since i don’t have Burp pro , intruder is very slow , just make sure you add the necessary headers , specially the token we got :

# Generate a List of numbers to Fuzz with
seq 1 1000 > numers

# Fuzzing using Ffuf :
ffuf -u http://154.57.164.71:31386/chat/?rid=FUZZ -w numbers -H "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36" -H "Cookie: session=eyJ1c2VyIjp7ImlkIjo1LCJ1c2VybmFtZSI6InRlc3QxMjM0NTY3ODkifX0.anTDeQ.fXgj63H-stLAy_T3_r1cETuBEps" -H "Referer: http://154.57.164.71:31386/chat/?rid=6" -H "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7" -fs 265

I filtered by Size 265 since that’s the size of the error response :

We see that we get another number which is 3 , now back to burp :

We see that we are able to access another user’s conversation and we get the flag that way .

This site was also vulnerable to an XSS vulnerability , we can easily test it using a basic XSS payload :

<script>alert(window.origin)</script>

But that’s not the point of this challenge .

That was all for this one, see you in the next one :)