Skip to main content
CPEBuddy
HackTheBox - Conversor

HackTheBox - Conversor

Source: YouTube · IppSec · published Mar 21, 2026 · 39:32

Cybersecurity
No ratings yet Log in to rate
Transcript Available
Description

The main goal is to demonstrate common overlooked vulnerabilities in the "Converser" Hack The Box machine, specifically focusing on XSLT injection and path traversal 0:04.

Key Takeaways:
• The foothold involves a web app that converts XML files using XSLT, often for generating Nmap scan reports 0:11.
• The primary attack vector is achieving a file write through XSLT injection 0:24.
• The application is also vulnerable to vanilla path traversal, which is a common oversight 0:28.
• Both user and root access have unintended but common exploitation paths 0:06.

This box serves as a valuable lesson in recognizing standard web application flaws that are frequently missed during penetration testing.

Sources:

  • 0:04 Introduction to the Converser Hack The Box machine.
  • 0:11 Description of the web app's XML to XSLT conversion functionality.
  • 0:24 Explanation of the XSLT injection file write vulnerability.
  • 0:28 Mention of the vanilla path traversal vulnerability.

Generate CPE Credits

Generate a professional CPE document from this video's transcript.

Estimated credit: 0.5 CPE hours

Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.

Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.

CISSP Domain Mapping
Learning Objectives
Self-Assessment Questions
PDF Export Ready

Free account. One generation at a time, with a daily limit.

CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.

Watch on YouTube

Transcript Preview

First 800 characters of the transcript

What's going on YouTube? This is Ippsec, and today we'll be doing Converser from Hack The Box, which is an easy box that I found pretty interesting because both the user and root have unintended paths that are somewhat common, but many people just overlook them. The foothold is a web app that transforms XML files with XSLT, and the example is making web reports of Nmap scans. With accepting two file types, it's obvious the box wants you to attack the file conversion process. In this case, it's achieving a file write through XSLT injection. However, it's also vulnerable to a vanilla path traversal. So, if you did this box and missed that, let me know in the comments cuz I'd be interested to hear about it. I think it does a good job at showing how common vulnerabilities can just hide in plai…