OmniWatch

hackthebox

Task: Obtain admin access to a multi-service web application with Varnish cache, Zig HTTP backend, Flask controller, and a Chromium bot. Solution: Chain CRLF injection in http.zig to inject CacheKey header for Varnish cache poisoning with XSS, steal moderator JWT via bot timing, use LFI to read JWT secret, forge admin JWT, and use stacked SQL injection to insert signature.