text: What's going on, YouTube? This is IPSC, and we'll be solving an easy web challenge that was created as a teaser for the Hack the System CTF, Hack the Box is running between June 27th and 29th. This CTF contains five web challenges based upon real bug bounty reports. It's free to join and the winning team will get up to three silver academy vouchers that will include the ability to take the certified bug bounty hunter exam. As part of the promotion for the event, two teaser challenges were created. I'll be covering critical ops challenge and OXDF will cover the Nova Energy. Both challenges are free to play now over on the CTF platform. And I'll put a link in the description for everything. Anyways, let's just hop in and start solving Critical Ops. So, to play this challenge, we're going to go

title: HackTheBox - CriticalOps


text: to the Hack the System Bug Bounty CTF playground and then click play CTF.

title: HackTheBox - CriticalOps


text: You'll probably have to join the event first if you haven't joined it, but that will get you to this page where we can spawn the machine. Um, if you want to, while you're here, you can go to the upcoming, click on the one without a playground, the hack the system bug bounty CTF, and click it, and they can join the event. So, you can play it soon as it goes live on the 29th. And if you're waiting to join it, you can just go over to joined, and you can see it here, right? But going back to the playground, we see two challenges, critical ops and Nova ch uh Nova Energy.

title: HackTheBox - CriticalOps


text: I'm going to do the critical ops one.

title: HackTheBox - CriticalOps


text: So, I'm going to click on that, then click spawn docker, and it spawn near instantly. It normally takes like 10 to 15 seconds. If after 30 or 45 seconds you don't have an IP, just try refreshing the page and that's normally enough to fix it, right? And before we start, we should always read the scope or the description around it. You never want to go into bug bounty and just go hack all the things, right? Always read the scope and find out what they want you to do because you don't want to go and violate that, right? So, we can see this is just a description. Critical Ops is a web application that monitors several critical infrastructures. Users interact with the website to report things and submit tickets. Essentially, they've asked us to hunt for any potential security issues in their application and retrieve flags stored in

title: HackTheBox - CriticalOps


text: the site. And it also gives us a bug bounty report that this challenge was inspired by. If we click that, it's going to tell us it's client side JWT, which makes this challenge really easy.

title: HackTheBox - CriticalOps


text: The challenge itself is very easy, so it's not meant to be that hard. Just kind of give you a taste of the CTF platform. But this is showing a um JDT secret that was code um hardcoded in Zenesk. Um we're going to act like we didn't see this cuz if we just jump and go straight to um finding a JDT in some JavaScript source, this video will be like another 30 seconds. Um so I'm going to attempt to go to the page. I see a plain HTTP request was sent to an HTTPS port. So I'm going to put that in. And now we can go to the page. So, we don't have too much. Nothing really is clicking. Uh, we could go log into the dashboard. There's no like forgot password thing. We can register an account, though. But, I'm kind of getting ahead of myself. The first thing I always like doing is looking at the um page source. And I see next. So, there

title: HackTheBox - CriticalOps


text: was like a Next.js um middleware vulnerability a while ago. So, that could be something. Um, let's see. Is there anything else? I'm looking for maybe like React View or something like that. Um, but we just get a bunch of JavaScript here and reading this source is painful. So, I'm not going to really do too much. It's loading a bunch of things in chunks. And yeah, so we don't get much information there. I also like just getting like random 404 errors. Um, this looks very similar to just being some type of JavaScript framework. That's normally how I see them. I guess maybe Laravel has an error message kind of like this, but um I don't think this indicates any framework uh we know, right? If we go to like 404 um error pages oxdf uh he has a lot of them cataloged. So if we click this once the page loads, I know my internet

title: HackTheBox - CriticalOps


text: is going a little bit slow. We have a bunch of just default ones. Oh, actually 404 not found. This page, this looks very much like Laravel. So, I wonder if this is going to be a PHP backend. Um, and knowing it's PHP backend just gives us ideas of what we can exploit down the line, right? If we ever have a file upload vulnerability, you want to upload things with the PHP extension and see if you can trick it into getting code execution. So, that is interesting.

title: HackTheBox - CriticalOps


text: Let's see. Let's go to login. We can register an account. I'm going to do IPSC and I'm going to add bug bounty to the end of it. Normally in the scope they will um potentially tell you if you should have a slug or anything on your username that designates what you're signing up for. Um if they don't, I normally like just adding it myself just so um they know why I'm here, right? So let's go ahead and add ipsc bug bounty log in with my secret password of password and we get logged into the site. Awesome. So let's see what do we have here. There's really not much. I'm going to start intercepting in Burpswuite to see what goes on in the background. Uh, I guess we have to accept all the defaults because it wasn't started.

title: HackTheBox - CriticalOps


text: Um, let's see. Refresh this page.

title: HackTheBox - CriticalOps


text: Refusing connections. Come on, Bert.

title: HackTheBox - CriticalOps


text: Once this starts proxy, let's turn you off. Reload this page.

title: HackTheBox - CriticalOps


text: Accept the risk. There we go. So, if I look at HTTP history, we can start seeing things. We're getting um an API.

title: HackTheBox - CriticalOps


text: So, what I want to do, go over to repeater, send this. We hit some type of API.

title: HackTheBox - CriticalOps


text: Um does this have a different 404 page?

title: HackTheBox - CriticalOps


text: Uh this looks to be the same exact thing.

title: HackTheBox - CriticalOps


text: Um let's see. API docs is a common one.

title: HackTheBox - CriticalOps


text: Let's see. That's a 404 not found. Um, we could try doing just a custom like brute force inside of this directory, but it doesn't look like we're getting anything here. Um, let's go back to the water level trend and let's see if I remove my O token. Send it. It still works. So, we have a IOR vulnerability.

title: HackTheBox - CriticalOps


text: Although it may not be a vulnerability because there's nothing sensitive here.

title: HackTheBox - CriticalOps


text: It's just this endpoint does not require any authentication. So, that's something I would look at. look at all the APIs it interacts with and see if there's anything we can do. Um, we did get tickets here. I don't know what that's doing. Um, controls again doesn't really look like anything special. So, let's go over to tickets and we can report a new ticket. Let's do test. Test submit. New incident. Must be five characters and this must be 10. So, let's just put 10 characters. We can submit it. Look at incidents. We see it here. If we look at what we posted, we can see if there's any other fields that we may want. Doesn't look like it.

title: HackTheBox - CriticalOps


text: So, at this point, um I guess we can try like SQL injection. Uh let's go proxy where we posted. Send it. I'm going to put a um bunch of special characters to test for various things. We can copy it and put it for the description as well.

title: HackTheBox - CriticalOps


text: And why not the priority? put that payload everywhere. Um, invalid property value. Maybe we need to have this medium.

title: HackTheBox - CriticalOps


text: Uh, there we go.

title: HackTheBox - CriticalOps


text: So, we have now submitted this. If we go uh back to get tickets, we can see it's just listing all of our tickets. Um, we have the authorization in two different places. We have it in the cookie and the body here. If we delete it out of both, I'm going to test for an ID door vulnerability again, we get unauthorized. So there is um authentication put around this. So now I want to look at my actual JWT token, right? So I'm just going to copy this and easy way is always going to JWTO.

title: HackTheBox - CriticalOps


text: Then you can paste the token in and then it has a nice um display, right? this first period of uh base 64 that's just going to be algorithm it's signed with HS 256 and then the body which is going to be after the period right here that's just going to be all this information I'm guessing we probably want to change the role over to an admin and then there's also this UU ID it's not going to be that helpful here but one thing I have started doing is identifying the version of UU ID if we Google UID version identifier we'll be able to see this and I say it's not that helpful because um the UID of a user normally isn't that impactful, right? But sometimes you may have like a um UID of files where you upload things, right? And if you guess the UID, then you'll be able to get to documents if they don't have um

title: HackTheBox - CriticalOps


text: secure things around that, right? So if you can identify how they generate the UU ID and it's not random based, you may have a better way to brute force UIDs.

title: HackTheBox - CriticalOps


text: We're at version four, which is random.

title: HackTheBox - CriticalOps


text: So, that's not an attack here. I just wanted to kind of highlight of something I would look at, right? We can see the different versions. I forget which one is vulnerable. Um, but yeah, some of them aren't random. They're just like based upon the time or something like that. And they can brute force it and then um get listings that way. So, let's see what else do we have. Um, let's go take a step back. I'm going to go to login. So, I'm going to go ipssebug bounty and then put the password of password. Let's make sure I'm intercepting login. And we can see the login request. We could try like no SQL injection here and things like that.

title: HackTheBox - CriticalOps


text: But if I just send this payload, there's something missing in this request.

title: HackTheBox - CriticalOps


text: um we don't have any like cookies here, no cookies here, but after this we start having cookies. So this indicates that the client has some way to generate their own cookie. So let's take a look at that real quick. So I'm going to go um let's see. Let's just go back in the application. I'm going to turn intercept off. Um I definitely want to go to the login page.

title: HackTheBox - CriticalOps


text: So we're at login. I'm going to press F12 and go into debugger webpack and then go on page.tsx and I'm already here actually um it should be up here but we see we're importing generate token from lib JWT and that generate token where is it is right here. So this is going to be all client side potentially, right? So let's see what happens in generate token. So I'm going to go over to lib, go over to JWT, and looking at J um generate token.

title: HackTheBox - CriticalOps


text: We're going to assign it with a payload.

title: HackTheBox - CriticalOps


text: We're going to assign it with secret.

title: HackTheBox - CriticalOps


text: And if we look up here, we have the JWT secret right here. Secret key critical ops 2025. So this is going to allow us to forge our JWTs. And to do that, I'm going to install an extension of Burp Suite. If we um a lot of people don't really use JWTO, they would just do it all within Burp. If we go to the B app store, let's see. It's going to be under the J's. I think it's JWT editor.

title: HackTheBox - CriticalOps


text: Um let's see, JSON JWT editor. I'm going to install this plugin.

title: HackTheBox - CriticalOps


text: And what that's going to do is um requests that have a JWT. I think I have to do like a new request. Let's do IPSC bug bounty password.

title: HackTheBox - CriticalOps


text: Let's see. The ones that have JWTs is going to be highlighted in green. It's also going to add the token here. Um I know my font size a bit big so it's not the most pretty thing to look at. But we can edit anything we want. So we could change a role over to admin. We probably have to do that in the repeater. So, let's go back to here. I'm going to go back to the ticket endpoint.

title: HackTheBox - CriticalOps


text: We can go to repeater, change the role to admin, and then sign it. And we have no signing keys have been added to the keys tab. So, I'm going to go to JDT editor, new symmetric key. I'm going to specify the secret. I'm going to put the secret from that source code. Uh, we can generate any ID we want. And now we have a private key that we can use for signing. and go to repeater. Let's click sign. Um, don't modify the header.

title: HackTheBox - CriticalOps


text: That's fine. So, now our JBT says we're an admin. So, I'm going to go back to my request. We're going to send it and unauthorized.

title: HackTheBox - CriticalOps


text: Maybe I didn't copy something correctly.

title: HackTheBox - CriticalOps


text: Uh, let's see. We got admin JBT editor.

title: HackTheBox - CriticalOps


text: Specify the secret. Where is it?

title: HackTheBox - CriticalOps


text: Secret key critical ops 2025. Copy that.

title: HackTheBox - CriticalOps


text: Paste.

title: HackTheBox - CriticalOps


text: Okay. I'm actually going to delete. Hopefully I'm doing this correctly.

title: HackTheBox - CriticalOps


text: Yes.

title: HackTheBox - CriticalOps


text: Okay, we have the key.

title: HackTheBox - CriticalOps


text: Sign.

title: HackTheBox - CriticalOps


text: Okay.

title: HackTheBox - CriticalOps


text: Send.

title: HackTheBox - CriticalOps


text: There we go.

title: HackTheBox - CriticalOps


text: So, maybe I pasted something wrong, but we see all the tickets here, and we're an admin, so we now see tickets that don't belong to us. And we have the title who put JBT in client side LMAL.

title: HackTheBox - CriticalOps


text: So we can do this. Uh let's go back over to the event. I'm going to turn Burp Suite off. Submit the flag.

title: HackTheBox - CriticalOps


text: And there we go. We got the flag. So that's going to be the challenge. Um yeah, I hope you guys enjoyed it. Um normally I wouldn't like end my bug bounty career right here. The report.

title: HackTheBox - CriticalOps


text: Um, I'd submit the report, try to get the money, but one of the things I think many people miss out on bug bounty is they try to do everything manually, right? After I'd find something in bug bounty, I try to find a way to automate it. Cuz if you're attacking every company by hand, like if we have a list of 200 companies and we want to test each company for this vulnerability, if we do it by hand, that's going to take a long time, right? It's much better to automate that process and then just test 200 companies at once. And that's a more guaranteed way to get an income because now you're just taking like easy vulnerabilities, scanning a lots of places and then hoping to get one versus where if you just start picking companies to attack, going very deep.

title: HackTheBox - CriticalOps


text: You're wasting a lot of time. You may not get money from that. And yeah, I just always find it better to um do automation and bug bounty and try to cast the net wide as possible. Um, hopefully that end kind of made sense.

title: HackTheBox - CriticalOps


text: But that's going to be the video. Take care and I will see you all next time.

title: HackTheBox - CriticalOps