HackTheBox - CriticalOps

IppSec · Beginner ·🔧 Backend Engineering ·1y ago

Skills: Ethical Hacking & Pen Testing90%

Key Takeaways

Introduces the HackTheSystem Bug Bounty CTF and solves the CriticalOps teaser challenge

Original Description

HackTheBox is running a Bug Bounty themed CTF, HackTheSystem June 27-29 2025. These challenges are all based on real bug bounty reports. There are two teaser challenges that are out now! I'll showcase one of them, CriticalOps. HackTheSystem - Bug Bounty CTF: https://ctf.hackthebox.com/event/details/hack-the-system-bug-bounty-ctf-2508 HackTheSystem Teaser Playground: https://ctf.hackthebox.com/event/details/hack-the-system-bug-bounty-ctf-playground-2509 NovaEnergy Challenge w/ 0xdf: https://www.youtube.com/watch?v=Ru5toDyKNjg 00:00 - Introduction 01:30 - Looking at the challenge description 02:50 - Examining the website, trying to identify how the website is configured 04:40 - Registering an account 06:40 - Playing with the ticket submission 08:00 - Looking into the UUID 09:50 - Examining the login request and noticing the server doesn't give us an auth cookie, going to the javascript source and finding a hardcoded secret value 11:30 - Installing the JWT Editor Burpsuite Plugin and then forging a JWT as admin 13:00 - Looking at the tickets as an admin and getting the flag

Watch on YouTube ↗ (saves to browser)

Sign in to unlock AI tutor explanation · ⚡30

Playlist

Uploads from IppSec · IppSec · 0 of 60

← Previous Next →

HHC2016 - Analytics

HHC2016 - Analytics

HackTheBox - October

HackTheBox - October

HackTheBox - Arctic

HackTheBox - Arctic

HackTheBox - Brainfuck

HackTheBox - Brainfuck

HackTheBox - Bank

HackTheBox - Bank

HackTheBox - Joker

HackTheBox - Joker

HackTheBox - Lazy

HackTheBox - Lazy

Camp CTF 2015 - Bitterman

Camp CTF 2015 - Bitterman

HackTheBox - Devel

HackTheBox - Devel

Reversing Malicious Office Document (Macro) Emotet(?)

Reversing Malicious Office Document (Macro) Emotet(?)

HackTheBox - Granny and Grandpa

HackTheBox - Granny and Grandpa

HackTheBox - Pivoting Update: Granny and Grandpa

HackTheBox - Pivoting Update: Granny and Grandpa

HackTheBox - Optimum

HackTheBox - Optimum

HackTheBox - Charon

HackTheBox - Charon

HackTheBox - Sneaky

HackTheBox - Sneaky

HackTheBox - Holiday

HackTheBox - Holiday

HackTheBox - Europa

HackTheBox - Europa

Introduction to tmux

Introduction to tmux

HackTheBox - Blocky

HackTheBox - Blocky

HackTheBox - Nineveh

HackTheBox - Nineveh

HackTheBox - Jail

HackTheBox - Jail

HackTheBox - Blue

HackTheBox - Blue

HackTheBox - Calamity

HackTheBox - Calamity

HackTheBox - Shrek

HackTheBox - Shrek

HackTheBox - Mirai

HackTheBox - Mirai

HackTheBox - Shocker

HackTheBox - Shocker

HackTheBox - Mantis

HackTheBox - Mantis

HackTheBox - Node

HackTheBox - Node

HackTheBox - Kotarak

HackTheBox - Kotarak

HackTheBox - Enterprise

HackTheBox - Enterprise

HackTheBox - Sense

HackTheBox - Sense

HackTheBox - Minion

HackTheBox - Minion

VulnHub - Sokar

VulnHub - Sokar

VulnHub - Pinkys Palace v2

VulnHub - Pinkys Palace v2

HackTheBox - Inception

HackTheBox - Inception

Vulnhub - Trollcave 1.2

Vulnhub - Trollcave 1.2

HackTheBox - Ariekei

HackTheBox - Ariekei

HackTheBox - Flux Capacitor

HackTheBox - Flux Capacitor

HackTheBox - Jeeves

HackTheBox - Jeeves

HackTheBox - Tally

HackTheBox - Tally

HackTheBox - CrimeStoppers

HackTheBox - CrimeStoppers

HackTheBox - Fulcrum

HackTheBox - Fulcrum

HackTheBox - Chatterbox

HackTheBox - Chatterbox

HackTheBox - Falafel

HackTheBox - Falafel

How To Create Empire Modules

How To Create Empire Modules

HackTheBox - Nightmare

HackTheBox - Nightmare

HackTheBox - Nightmarev2 - Speed Run/Unintended Solutions

HackTheBox - Nightmarev2 - Speed Run/Unintended Solutions

HackTheBox - Bart

HackTheBox - Bart

HackTheBox - Aragog

HackTheBox - Aragog

HackTheBox - Valentine

HackTheBox - Valentine

HackTheBox - Silo

HackTheBox - Silo

HackTheBox - Rabbit

HackTheBox - Rabbit

HackTheBox - Celestial

HackTheBox - Celestial

HackTheBox - Stratosphere

HackTheBox - Stratosphere

HackTheBox - Poison

HackTheBox - Poison

HackTheBox - Canape

HackTheBox - Canape

HackTheBox - Olympus

HackTheBox - Olympus

HackTheBox - Sunday

HackTheBox - Sunday

HackTheBox - Fighter

HackTheBox - Fighter

HackTheBox - Bounty

HackTheBox - Bounty

More on: Ethical Hacking & Pen Testing

View skill →

HackTheBox - Photobomb

HackTheBox - Photobomb

VulnHub - Sokar

VulnHub - Sokar

HackTheBox - Multimaster

HackTheBox - Multimaster

Hacking a Smart Camera: IoT Hacking With Andrew Bellini (Part 3)

Hacking a Smart Camera: IoT Hacking With Andrew Bellini (Part 3)

The Cyber Mentor

Ethical Password Cracking

Ethical Password Cracking

Exploitation and Penetration Testing with Metasploit

Exploitation and Penetration Testing with Metasploit

Related AI Lessons

The Only Git Commands You Actually Need — 47 Patterns for Daily Work

Master the essential Git commands to boost your development productivity

Dev.to · The AI producer

Common Next.js Errors (and How I Solved Them)

Learn to troubleshoot common Next.js errors and improve your development workflow

Dev.to · gary killen

Applying Scalability in Backend (CodeBuddy)

Learn to apply scalability in backend development for efficient system performance

Why Every Backend Developer Should Learn Nginx Before Going to Production

Learn Nginx to improve backend development skills and ensure smooth production deployment

Medium · DevOps

Chapters (9)

Introduction

1:30 Looking at the challenge description

2:50 Examining the website, trying to identify how the website is configured

4:40 Registering an account

6:40 Playing with the ticket submission

8:00 Looking into the UUID

9:50 Examining the login request and noticing the server doesn't give us an auth co

11:30 Installing the JWT Editor Burpsuite Plugin and then forging a JWT as admin

13:00 Looking at the tickets as an admin and getting the flag

This Cop Was Held Accountable For His Brutality! #police #lawyer