CandyVault

Platform: HackTheBox | Category: Web | Difficulty: Very Easy | Author: D3v0o0Nu11 | Date: 2026-02-10

Description

The malevolent spirits have concealed all the Halloween treats within their secret vault, and it's imperative that you decipher its enigmatic seal to reclaim the candy before the spooky night arrives.

Solution Approach

Core idea: Source Code Review. Basic NoSQL Injection.

Steps

1. In this challenge we're given the source code which we will review later.

2. Seems there is no register option, hence the objective might be to bypass the login page.

3. Upon reviewing the source code, seems after successfully bypass the login page, the webserver shall renders candy.html page and the flag shall rendered there.

4. Great! Now let's identify what DB type it used so we can choose the correct SQLi payload.

5. Reviewing the config.py file, we can identify that the webserver using MONGODB.

6. Next, reviewing the migrate.py source, it's clear that the DB used is MONGODB.

7. Searching on the internet for nosql payload, found these results.

8. Nice! Let's try to intercept the request using burpsuite then change the value for email and password.

IN BURPSUITE

1. Noticed the input format is not in JSON, hence we need to manipulate the content-type header.
2. And used this payload:

NOTE:

Change the JSON paramater --> username, to email.

1. Got the flag!

Flag

REDACTED

Lessons Learned

1. Source Code Review.
2. Basic NoSQL Injection.