Hack The Box12

Spellbound ServantsOwnhace 1 mes

LoveTokOwnhace 1 mes

baby nginxatsuOwnhace 1 mes

baby WAFfles orderOwnhace 1 mes

baby todo or not todoOwnhace 1 mes

baby interdimensional internetOwnhace 1 mes

TemplatedOwnhace 1 mes

jscalcOwnhace 1 mes

Lazy BallotOwnhace 1 mes

NovaEnergyOwnhace 1 mes

Full Stack ConfOwnhace 1 mes

baby BoneChewerConOwnhace 1 mes

BBLABS42 resueltos

Mediumself_svg_XSS — Self-XSS → Bot-Assisted ATO via SVG uploadXSS$750hace 1 sem MediumOAuth Authorization Code Theft via Open RedirectOpen Redirecthace 2 sem Medium6 Progressive DOM XSS ChallengesXSShace 3 sem InsaneSQL Injection en identificador de tabla → RCE por PostgreSQL `COPY … FROM PROGRAM`SQLi · RCE$700hace 3 sem InsaneStored XSS to Domain TakeoverXSS$1200hace 3 sem HardBusiness Logic Error - Payment Bypass via Client-Side Trust AbuseBusiness Logic$4450hace 4 sem MediumSubdomain Takeover via Dangling CNAMEBusiness Logichace 4 sem MediumRace Condition in Vote/Review SystemRace Conditionhace 4 sem MediumRace Condition in Plan Coupon LimitsRace Conditionhace 4 sem MediumRace Condition in Coupon ApplicationRace Conditionhace 4 sem InsaneWizard Takeover ATO ( IDOR + CSRF )CSRF · IDOR$1500hace 4 sem EasyOpen Redirect PlaygroundOpen Redirecthace 1 mes EasyCSRF Form-Based Post CreationCSRFhace 1 mes HardSSRF via HTML Injection in PDF GenerationSSRFhace 1 mes MediumNASA - Rails Approval Bypass via Mass AssignmentAuth Bypass · API Abusehace 1 mes EasyCSRF Account DeletionCSRFhace 1 mes Easy12 DOM XSS Parameters for Automated ScanningXSShace 1 mes HardClient-Side Permission Bypass + SVG XSS + Cookie TheftBusiness Logichace 1 mes HardNASA - Client-Side Auth Bypass via Match & ReplaceAuth Bypass · BAChace 2 meses HardWeb Cache Deception & BAC in /uploadsAuth Bypass · BAChace 2 meses EasyStored XSS in Post BodyXSShace 2 meses EasyPath Traversal via Avatar UploadPath Traversalhace 2 meses EasyReflected XSS on 404 Error PageXSShace 2 meses MediumPayment Bypass via Business Logic FlawBusiness Logic$1000hace 3 meses EasyOpen Redirect in Checkout FlowOpen Redirecthace 3 meses Insane0-click-ATO — Account Takeover via OTP Brute Force + Email Case-Sensitivity BypassAPI Abuse$600hace 3 meses EasyOpen Redirect in Login/LogoutOpen Redirecthace 3 meses EasyCSRF Password ChangeCSRFhace 3 meses EasyMass Assignment Privilege Escalation LabAPI Abusehace 3 meses HardAdvanced IDOR ChallengesIDORhace 3 meses EasyURL Shortener Open RedirectOpen Redirecthace 3 meses HardBlind SSRF with Internal HeadersSSRFhace 3 meses HardIDOR via Predictable Checkout IDsBusiness Logic · IDOR$500hace 3 meses HardIDOR + CORS Chain AttackIDOR · Business Logic$50hace 3 meses MediumHTTP Method Override & Admin Bot ExploitationCSRF · API Abuse$200hace 3 meses MediumSSRF Internal Network Scanning & Credential ExfiltrationSSRFhace 3 meses MediumClient-Side Role Bypass + Missing Server RBACBusiness Logichace 3 meses MediumStored XSS via SVG File UploadXSS$750hace 3 meses MediumStored XSS to Admin Password ChangeXSShace 3 meses MediumBroken Function Level AuthorizationAPI Abusehace 3 meses EasyMass Assignment Privilege EscalationAPI Abusehace 3 meses EasySSRF with Corporate Token ExfiltrationSSRFhace 3 meses

Actividad reciente6

Lab resuelto · self_svg_XSS — Self-XSS → Bot-Assisted ATO via SVG uploadhace 1 sem

Lab resuelto · OAuth Authorization Code Theft via Open Redirecthace 2 sem

Lab resuelto · 6 Progressive DOM XSS Challengeshace 3 sem

Lab resuelto · SQL Injection en identificador de tabla → RCE por PostgreSQL `COPY … FROM PROGRAM`hace 3 sem

Lab resuelto · Stored XSS to Domain Takeoverhace 3 sem

Lab resuelto · Business Logic Error - Payment Bypass via Client-Side Trust Abusehace 4 sem

Toda la actividad2 métricas

Machines109

Bounty$12k

Avales

Avales

Alexander Saquinga — perfil de ciberseguridad

Avales

Crea tu perfil de ciberseguridad verificado

Alexander Saquinga — perfil de ciberseguridad

Avales

Crea tu perfil de ciberseguridad verificado