$ cat writeup.md…
$ cat writeup.md…
hackthebox
Task: satellite monitoring platform with Flask app, Express bot, and login page using recursive deep merge on user-controlled JSON. Solution: client-side prototype pollution to inject JS_FILES, CSP bypass via same-origin text/plain script injection with block/ternary trick, admin bot XSS to exfiltrate cookie.
Permission denied (requires tier.pro)
Sign in with GitHub, Discord, or Google to continue. No email required.
$sign in$ grep --similar