baby todo or not todo

Platform: HackTheBox | Category: Web | Difficulty: N/A | Author: D3v0o0Nu11 | Date: 2026-02-10

Description

I'm so done with these bloody HR solutions coming from those bloody HR specialists, I don't need anyone monitoring my thoughts, or do I... ?

Solution Approach

Core idea: Identify the weakness from source review or fingerprinting first. Iterate with incremental payloads instead of guessing.

Steps

1. First, open the host given.

2. Try to input <script>alert('1')</script> to the textbox.

3. Hmm let us analyze index.html then.

4. Something caught my attention.

5. Try to run getstatus('all') at the webapps's console then.

6. Hmm.. let us run setInterval(update,3000) then.

7. Nothing happens.

8. Try setInterval(getTasks('userce6aB01E'), 3000).

9. Again nothing happen, i tried to change the parameter of getTasks to all.

10. Looks like we can see the flag there.

11. But since it closed too fast, use Burp Suite to catch request, then send the request to repeater.

12. Got the flag!

Flag

REDACTED

Lessons Learned

1. Identify the weakness from source review or fingerprinting first.
2. Iterate with incremental payloads instead of guessing.
3. Reuse the same pattern in future engagements.