webPromedium
Блекджек на раздевание (Stripping Blackjack)
bug-makers
Task: Express.js blackjack game rigged to always win (botWinPercentage=100), with SQLi in winners search, exposed backup revealing prototype pollution path, and admin panel leaking JWT secret. Solution: chain SQLi → admin credential extraction → MD5 cracking → JWT secret leak → JWT forgery with __proto__ prototype pollution payload to set botWinPercentage=0 → win 3 games.
$ ls tags/ techniques/
sqlitesql_injectiongame_hackingmd5_crackingprototype_pollutionexpress_jsjwt_forgerydeepmergenode_jsblackjack
union_sql_injectionjwt_forgeryjwt_secret_extractionadmin_panel_accessprototype_pollution_via_deepmergemd5_password_crackingsource_code_analysis_via_backup
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Sign in with GitHub to continue. No email required.
$sign in$ grep --similar
Similar writeups
- [web][Pro]Скоростные Пазлы – 2 (Speed Puzzles – 2)— bug-makers
- [web][Pro]Арифметика (Arithmetic)— duckerz
- [web][Pro]Object Master— hackerlab
- [web][Pro]Совсем слепая инъекция (Completely Blind Injection)— bug-makers
- [web][Pro]Покажи, если сможешь (Show me if you can)— bug-makers