Don't Overreact

Platform: HackTheBox | Category: Mobile | Difficulty: N/A | Author: D3v0o0Nu11 | Date: 2026-02-10

Description

Some web developers wrote this fancy new app! It's really cool, isn't it?

Solution Approach

Core idea: Identify the weakness from source review or fingerprinting first. Iterate with incremental payloads instead of guessing.

Steps

1. First, unzip the .zip file given.

2. To reverse engineer APK file, i used apktool.

COMMAND -> apktool d app-release.apk

1. Jump to the folder.

2. Let us check the assets directory.

3. Check the file type.

4. Try to combine strings with grep to find the flag prefix.

5. Didn't find it, but a string caught my attention.

SFRCezIzbTQxbl9jNDFtXzRuZF9kMG43XzB2MzIyMzRjN30=

1. Looks like a base64 encoded text.

2. Decode it.

3. Got the flag!

Flag

REDACTED

Lessons Learned

1. Identify the weakness from source review or fingerprinting first.
2. Iterate with incremental payloads instead of guessing.
3. Reuse the same pattern in future engagements.