OpenSecret

Platform: HackTheBox | Category: Web | Type: Challenge | Difficulty: Easy | OS: NA | Author: D3v0o0Nu11 | Date: 2026-01-26 | Status: Solved Techniques: jwt_forgery, source_code_analysis

Summary

Task: Gain access to a protected section of a website. Solution: Found hardcoded JWT secret in frontend JavaScript, forged admin token to access restricted /tickets endpoint.

Recon

Port scan

nmap -p- -sV -sC <TARGET> --min-rate 1000 -Pn

Enumeration highlights

• Event: hackthebox | ID: 20260126_hackthebox_opensecret
• Tags: jwt, information_disclosure, hardcoded_secret
• Indicators: hardcoded secret in JS, JWT authentication
• Source: 20260126_hackthebox_opensecret.md

Foothold

Vulnerability / Misconfiguration

1. Jwt_forgery
2. Source_code_analysis

<command>

Exploitation

• See original writeup content for detailed exploitation.

Privilege Escalation

Enumeration

sudo -l
find / -perm -4000 2>/dev/null
getcap -r / 2>/dev/null
cat /etc/crontab
ps aux

Exploitation

1. N/A for challenge-type writeup; see exploitation above.
2. Flag obtained via challenge solve.

<command>

Flags

Key Takeaways / Lessons

• jwt_forgery
• source_code_analysis
• Tags: jwt, information_disclosure, hardcoded_secret

Original Writeup

<details><summary>Click to expand original content</summary>

OpenSecret — hackthebox

Description

OpenSecret is a web challenge where you need to gain access to a protected section of the website.

Analysis

While examining the frontend source code (JavaScript files), a hardcoded secret key for signing JWT tokens was discovered.

// snippet from frontend JS
const JWT_SECRET = "super_secret_key_123"; 

The application uses JWT for user authentication. Having the secret key, we can create (forge) a token for any user, including the administrator.

Solution

1. Finding the secret: Open browser developer tools (F12), go to the "Sources" or "Network" tab and examine the loaded JS files. Find the variable containing the secret key.
2. Creating the token: Use the found key to create a new JWT. In the payload, set role: admin or username: admin (depending on what the server expects).
3. Accessing the flag: Replace the current token in Cookies or LocalStorage with the forged one and navigate to /tickets. There, in one of the internal notes, you'll find the flag.

Example code for token generation (Python)

import jwt

secret = "super_secret_key_123" # found key
payload = {
    "user": "admin",
    "role": "admin"
}

token = jwt.encode(payload, secret, algorithm="HS256")
print(token)

</details>

---

Auto-tracked: saved to WriteUps; run /xesor-revise to fold lessons into XESXor_Methodology.md.

signed by XESXOR