baby nginxatsu

Platform: HackTheBox | Category: Web | Difficulty: N/A | Author: D3v0o0Nu11 | Date: 2026-02-10

Description

Can you find a way to login as the administrator of the website and free nginxatsu?

Solution Approach

Core idea: Identify the weakness from source review or fingerprinting first. Iterate with incremental payloads instead of guessing.

Steps

1. First, open the host given.

2. Try to create new account.

3. Input the name & pass as admin, the email as admin123@gmail.com.

4. Now login with that creds.

5. Let us click generate config.

6. Click the config.

7. The comment caught my attention here.

8. Now add /storage/ at the url.

http://142.93.37.215:30822/storage/

1. Hmm.. let us check the bottom one.

2. Let us download the file.

3. Since it's a sqlite database, we can use online tools to view the data.

4. Crack the hash algorithm used for jr's password. To copy it, click this symbol first.

5. Try by MD5 first, the common one. I crack the pass using this website.

6. Nice.. Try the other.

7. Well i got nothing.

8. At this point we already know the email of jr and his pass, use his creds.

EMAIL -> nginxatsu-adm-01@makelarid.es
PASS -> adminadmin1

1. Got the flag!

Flag

REDACTED

Lessons Learned

1. Identify the weakness from source review or fingerprinting first.
2. Iterate with incremental payloads instead of guessing.
3. Reuse the same pattern in future engagements.