webhard

Proxy

hackthebox

A custom HTTP proxy written in Go that forwards requests to an internal Node.js backend. The goal is to exploit vulnerabilities to achieve command injection and read the flag.

$ ls tags/ techniques/
unicodecommand_injectionssrfnodejsgoexpresshttp_smugglingproxy
ifs_bypasscommand_injectionssrf_bypassturkish_i_attackhttp_request_smugglingfile_exfiltration
🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Create a free account with GitHub, then upgrade to Pro.

$ssh [email protected]