$ cat writeup.md…
$ cat writeup.md…
hackthebox
Task: A Go sender validates an action before forwarding the original JSON body to an internal Flask receiver. Solution: Mixed-case keys exploit different JSON name semantics so Go permits the request while Python selects the protected action.
Permission denied (requires tier.pro)
Sign in with GitHub, Discord, or Google to continue. No email required.
$sign in$ grep --similar