Spookifier

Platform: HackTheBox | Category: Web | Difficulty: Very Easy | Author: D3v0o0Nu11 | Date: 2026-02-10

Description

There's a new trend of an application that generates a spooky name for you. Users of that application later discovered that their real names were also magically changed, causing havoc in their life. Could you help bring down this application?

Solution Approach

Core idea: Identify the weakness from source review or fingerprinting first. Iterate with incremental payloads instead of guessing.

Steps

1. Let's open the host given.

2. Let's input Hallo.

3. Notice our input displayed as the parameter value.

4. Let's try to input addition. | ${1+3}

5. Based from the result we got, we can suggest that the website is vuln to SSTI.

6. Let's input another payload.

${system('cat flag.txt')}

1. Hmm.. try this one now:

 php read-only • copy allowed Copy
${open('/flag.txt').read()}

1. Got the flag!

Flag

REDACTED

Lessons Learned

1. Identify the weakness from source review or fingerprinting first.
2. Iterate with incremental payloads instead of guessing.
3. Reuse the same pattern in future engagements.