$ cat writeup.md…
$ cat writeup.md…
hackthebox
Task: Gain access to a protected section of a website. Solution: Found hardcoded JWT secret in frontend JavaScript, forged admin token to access restricted /tickets endpoint.
$ cat /etc/rate-limit
Rate limit reached (20 reads/hour per IP). Showing preview only — full content returns at the next hour roll-over.
OpenSecret is a web challenge where you need to gain access to a protected section of the website.
While examining the frontend source code (JavaScript files), a hardcoded secret key for signing JWT tokens was discovered.
// snippet from frontend JS const JWT_SECRET = "super_secret_key_123";
The application uses JWT for user authentication. Having the secret key, we can create (forge) a token for any user, including the administrator.
...
$ grep --similar