Skip to main content
CPEBuddy
HackTheBox - Heal

HackTheBox - Heal

Source: YouTube · IppSec · published May 17, 2025 · 37:26

Penetration Testing
No ratings yet Log in to rate
Transcript Available
Description

This video walkthrough covers the "Heel" machine from Hack the Box, demonstrating how to exploit a file disclosure vulnerability in a Ruby on Rails API to compromise a separate PHP-based Lime Survey application 0:03.

Key Takeaways:
• Initial reconnaissance reveals two subdomains running different tech stacks: a Ruby on Rails API and a PHP-based Lime Survey app 0:09.
• Although the PHP app seems like an easier target, there is no initial attack surface without valid login credentials 0:22.
• The actual entry point is a file disclosure flaw on the Rails API domain, allowing the exfiltration of the SQLite database 0:27.
• Exploiting the file disclosure requires navigating the Ruby on Rails file structure to locate the database configuration and the SQLite file 0:40.

By downloading and cracking the credentials from the leaked database, the attacker can successfully authenticate to the Lime Survey application to further their attack 0:34.

Sources:

  • 0:03 Introduction to the Heel Hack the Box machine
  • 0:09 Discovery of API and survey subdomains
  • 0:22 Lack of attack surface on the Lime Survey app
  • 0:27 File disclosure vulnerability on the API domain
  • 0:34 Extracting credentials for Lime Survey
  • 0:40 Navigating the Rails directory structure

Generate CPE Credits

Generate a professional CPE document from this video's transcript.

Estimated credit: 0.5 CPE hours

Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.

Topic: Penetration Testing. Commonly maps to: Security Assessment and Testing, Security Operations. Exact CISSP domains are assigned during generation.

CISSP Domain Mapping
Learning Objectives
Self-Assessment Questions
PDF Export Ready

Free account. One generation at a time, with a daily limit.

CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.

Watch on YouTube

Transcript Preview

First 800 characters of the transcript

What's going on YouTube? This is Ipsac doing Heel from Hack the Box, which is a nice medium box. And when you start this box, you quickly discover two subdomains that run vastly different technology stacks, an API and survey domain. The API subdomain is a Ruby on Rails app, and the survey is PHP running some software called Lime Survey. It's easy to focus in on the Lime Survey because many people are more familiar with PHP. But without credentials to log in, there isn't much we can do here. Looking at the API domain reveals a file disclosure vulnerability which you can use to excfiltrate the SQLite database and get credentials that let you log into Lime Survey. But the trick here is just navigating the Rails file structure as it's new to many people. But once you learn how the Rails app is…