Watch and track your favorite playlist.
Curated by: IppSec (543 videos)
HackTheBox is running a Bug Bounty themed CTF, HackTheSystem June 27-29 2025. These challenges are all based on real bug bounty reports. There are two teaser challenges that are out now! I'll showcase one of them, CriticalOps. HackTheSystem - Bug Bounty CTF: https://ctf.hackthebox.com/event/details/hack-the-system-bug-bounty-ctf-2508 HackTheSystem Teaser Playground: https://ctf.hackthebox.com/event/details/hack-the-system-bug-bounty-ctf-playground-2509 NovaEnergy Challenge w/ 0xdf: https://www.youtube.com/watch?v=Ru5toDyKNjg 00:00 - Introduction 01:30 - Looking at the challenge description 02:50 - Examining the website, trying to identify how the website is configured 04:40 - Registering an account 06:40 - Playing with the ticket submission 08:00 - Looking into the UUID 09:50 - Examining the login request and noticing the server doesn't give us an auth cookie, going to the javascript source and finding a hardcoded secret value 11:30 - Installing the JWT Editor Burpsuite Plugin and then forging a JWT as admin 13:00 - Looking at the tickets as an admin and getting the flag