SpookTastic

Platform: HackTheBox | Category: Web | Difficulty: Very Easy | Author: D3v0o0Nu11 | Date: 2026-02-10

Description

On a moonless night, you delve into the dark web to uncover the hacker group "The Cryptic Shadows." You find an encrypted message guiding you to a web challenge. They claim a cursed amulet, the 'Amulet of Samhain,' can unveil their treasures location

Solution Approach

Core idea: Source code review.

Steps

1. In this challenge, the source codes are disclosed.

2. Upon checking the functionalities in the webapp, found no other endpoints or features which is interesting.

3. But the webapp seems accept user input from the Newsletter section.

4. Let's review the source code at the Newsletter section.

5. Noticed the "Book Now" button shall executes --> javascript:void() every time users click the button to submit their input.

6. BUT, there is a certain condition to trigger this, because there is no direct calls for this function.

7. Reviewing the app.py script, found LOC that reflect the flag to the user desktop if an alert is happen.

8. Great! Let's just send simple XSS payload then.

9. I start by sending <script>alert('1')</script> but nothing happened.

10. Seems the webapp filters it, but after sent another simple xss payload --> ``, we got the flag!

Flag

REDACTED

Lessons Learned

1. Source code review.