Under Construction

Platform: HackTheBox | Category: Web | Difficulty: N/A | Author: D3v0o0Nu11 | Date: 2026-02-10

Description

A company that specialises in web development is creating a new site that is currently under construction. Can you obtain the flag?

Solution Approach

Core idea: Identify the weakness from source review or fingerprinting first. Iterate with incremental payloads instead of guessing.

Steps

1. First, open the host given.

2. Try with simple SQLi.

3. Let us choose register then.

4. Hmm.. let us check our cookies then to see if we can get any clue.

5. Seems like it's a JWT token. Open with this online tool.

6. Based on it, we know that this is an asymmetric JWT token (using private & public keys instead secret key).

7. So Researching JWT revealed token vulnerability, found out that we can do JWT Key Confusion Exploit.

JWT Key Confusion Exploit is an attack that simply using the pub key as our new signing secret key.

Flag

(no flag captured)

Lessons Learned

1. Identify the weakness from source review or fingerprinting first.
2. Iterate with incremental payloads instead of guessing.
3. Reuse the same pattern in future engagements.