OpenSecret — hackthebox

Description

OpenSecret is a web challenge where you need to gain access to a protected section of the website.

Analysis

While examining the frontend source code (JavaScript files), a hardcoded secret key for signing JWT tokens was discovered.

// snippet from frontend JS
const JWT_SECRET = "super_secret_key_123"; 

The application uses JWT for user authentication. Having the secret key, we can create (forge) a token for any user, including the administrator.

Solution

1. Finding the secret: Open browser developer tools (F12), go to the "Sources" or "Network" tab and examine the loaded JS files. Find the variable containing the secret key.
2. Creating the token: Use the found key to create a new JWT. In the payload, set role: admin or username: admin (depending on what the server expects).
3. Accessing the flag: Replace the current token in Cookies or LocalStorage with the forged one and navigate to /tickets. There, in one of the internal notes, you'll find the flag.

Example code for token generation (Python)

import jwt

secret = "super_secret_key_123" # found key
payload = {
    "user": "admin",
    "role": "admin"
}

token = jwt.encode(payload, secret, algorithm="HS256")
print(token)