OpenSecret

Platform: HackTheBox | Category: Web | Type: Challenge | Difficulty: Easy | OS: NA | Author: XESXOR | Date: 2026-01-26 | Status: Solved Techniques: jwt_forgery, source_code_analysis

Summary

Task: Gain access to a protected section of a website. Solution: Found hardcoded JWT secret in frontend JavaScript, forged admin token to access restricted /tickets endpoint.

OpenSecret — hackthebox

Description

OpenSecret is a web challenge where you need to gain access to a protected section of the website.

Analysis

While examining the frontend source code (JavaScript files), a hardcoded secret key for signing JWT tokens was discovered.

 javascript read-only • copy allowed Copy
// snippet from frontend JS
const JWT_SECRET = "super_secret_key_123"; 

The application uses JWT for user authentication. Having the secret key, we can create (forge) a token for any user, including the administrator.

Solution

1. Finding the secret: Open browser developer tools (F12), go to the "Sources" or "Network" tab and examine the loaded JS files. Find the variable containing the secret key.
2. Creating the token: Use the found key to create a new JWT. In the payload, set role: admin or username: admin (depending on what the server expects).
3. Accessing the flag: Replace the current token in Cookies or LocalStorage with the forged one and navigate to /tickets. There, in one of the internal notes, you'll find the flag.

Example code for token generation (Python)

 python read-only • copy allowed Copy
import jwt

secret = "super_secret_key_123" # found key
payload = {
    "user": "admin",
    "role": "admin"
}

token = jwt.encode(payload, secret, algorithm="HS256")
print(token)