HackTheBox - Caption
Source: YouTube · IppSec · published Jan 25, 2025 · 51:10
This video demonstrates a walkthrough of the Hack The Box "Caption" machine, focusing on exploiting infrastructure misconfigurations in a Varnish cache and HAProxy load balancer rather than traditional web application code 0:00.
Key Takeaways:
• The main difficulty is identifying that vulnerabilities lie within the infrastructure rather than the web code 0:04.
• The target sits behind a Varnish caching server and HAProxy load balancer, both containing misconfigurations 0:12.
• Varnish lacks proper hashing, serving the same cached page to all users, making it vulnerable to cache poisoning 0:18.
• Attackers can tamper with a tracking cookie to inject XSS into the cache, stealing an admin's cookie when they visit 0:25.
• The stolen cookie grants access to restricted endpoints, with the download feature containing a path traversal bug 0:34.
This machine serves as an excellent lesson in looking beyond application-level vulnerabilities to identify flaws in caching and proxy layers.
Sources:
- 0:00 Introduction to the Caption Hack The Box machine
- 0:04 Identifying infrastructure vs. web code vulnerabilities
- 0:12 Overview of the Varnish and HAProxy setup
- 0:18 Explaining the missing hashing misconfiguration in Varnish
- 0:25 XSS payload injection via cookie tampering
- 0:34 Path traversal bug in download endpoint
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 1 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Penetration Testing. Commonly maps to: Security Assessment and Testing, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
what's going on YouTube this is ipsec and today we'll be doing caption from hack the Box the main difficulty about this box is identifying the vulnerabilities because while it is web exploitation the vulnerabilities don't lie within the web code but instead the infrastructure itself the websites behind a varnish caching server and ha proxy load balancer both of which have misconfigurations the caching Server doesn't have any hashing configured so everyone gets the same cach page which means if we tamper with a a tracking cookie to poison the cash with a cross- a scripting payload anyone browsing that page will will hit our cross scripting payload and that's how we can get a admin cookie that lets us access other endpoints like logs and download which has a path traversal bug that lets us d…