Uploaded June 2025 | Updated September 2026, 2 weeks ago
HackTheBox is running a Bug Bounty themed CTF, HackTheSystem June 27-29 2025. These challenges are all based on real bug bounty reports. There are two teaser challenges that are out now! I'll showcase one of them, CriticalOps.
HackTheSystem - Bug Bounty CTF: ctf.hackthebox.com/event/details/hack-the-system-bug-bounty-ctf-2508
HackTheSystem Teaser Playground: ctf.hackthebox.com/event/details/hack-the-system-bug-bounty-ctf-playground-2509
NovaEnergy Challenge w/ 0xdf: youtube.com/watch?v=Ru5toDyKNjg
00:00 - Introduction
01:30 - Looking at the challenge description
02:50 - Examining the website, trying to identify how the website is configured
04:40 - Registering an account
06:40 - Playing with the ticket submission
08:00 - Looking into the UUID
09:50 - Examining the login request and noticing the server doesn't give us an auth cookie, going to the javascript source and finding a hardcoded secret value
11:30 - Installing the JWT Editor Burpsuite Plugin and then forging a JWT as admin
13:00 - Looking at the tickets as an admin and getting the flag
HackTheBox is running a Bug Bounty themed CTF, HackTheSystem June 27-29 2025. These challenges are all based on real bug bounty reports. There are two teaser challenges that are out now! I'll showcase one of them, CriticalOps.
HackTheSystem - Bug Bounty CTF: ctf.hackthebox.com/event/details/hack-the-system-bug-bounty-ctf-2508
HackTheSystem Teaser Playground: ctf.hackthebox.com/event/details/hack-the-system-bug-bounty-ctf-playground-2509
NovaEnergy Challenge w/ 0xdf: youtube.com/watch?v=Ru5toDyKNjg
00:00 - Introduction
01:30 - Looking at the challenge description
02:50 - Examining the website, trying to identify how the website is configured
04:40 - Registering an account
06:40 - Playing with the ticket submission
08:00 - Looking into the UUID
09:50 - Examining the login request and noticing the server doesn't give us an auth cookie, going to the javascript source and finding a hardcoded secret value
11:30 - Installing the JWT Editor Burpsuite Plugin and then forging a JWT as admin
13:00 - Looking at the tickets as an admin and getting the flag
