Spookifier

Platform: HackTheBox | Category: Web | Difficulty: N/A | Author: D3v0o0Nu11 | Date: 2026-02-10

Description

There's a new trend of an application that generates a spooky name for you. Users of that application later discovered that their real names were also magically changed, causing havoc in their life. Could you help bring down this application?

Solution Approach

Core idea: Identify the weakness from source review or fingerprinting first. Iterate with incremental payloads instead of guessing.

Steps

1. Open the host given.

2. Let us input Hallo.

3. Notice our input displayed as the parameter value.

4. Try to input addition. | ${1+3}

5. Based on the result we got, we can suggest that the website is vuln to SSTI.

6. Let us input another payload.

${system('cat flag.txt')}

1. Hmm.. try this one now:

${open('/flag.txt').read()}

1. Got the flag!

Flag

REDACTED

Lessons Learned

1. Identify the weakness from source review or fingerprinting first.
2. Iterate with incremental payloads instead of guessing.
3. Reuse the same pattern in future engagements.