webeasy
Flag Command
hackthebox
Task: Find a hidden command in a text-based adventure game web app. Solution: Inspect client-side JavaScript to find a secret key check in CheckMessage(), call /api/options to discover the hidden secret command string, and POST it to /api/monitor to receive the flag.
$ ls tags/ techniques/
source_code_reviewapi_endpoint_discoveryhidden_command_injection
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Create a free account with GitHub, then upgrade to Pro.
$ssh [email protected]