SpeedNet

hackthebox

Task: SpeedNet ISP platform with a React SPA over a GraphQL API. Solution: use enabled introspection, IDOR via userProfile to find admin, leak the reset token from a hidden devForgotPassword mutation to take over the admin account, then bypass nginx rate limiting with GraphQL aliased-mutation batching to brute-force the 4-digit 2FA OTP and read the flag from invoiceHistory.