HackTheBox - WhiteRabbit
Source: YouTube · IppSec · published Dec 13, 2025 · 1:22:45
This video walks through the "White Rabbit" Hack the Box machine, focusing on how a leaked HMAC signing key chains into a critical SQL injection vulnerability 0:00-0:22.
Key Takeaways:
• The initial attack surface is an unauthenticated Uptime Kuma instance, where light recon reveals a public status page leading to other internal domains 0:03-0:10.
• A wiki on one of the discovered domains documents a webhook pipeline to GoFish that uses HMAC signatures to prevent tampering 0:12-0:18.
• The critical flaw is that the HMAC signing key is leaked, allowing an attacker to manually sign and bypass the webhook's integrity checks 0:19-0:22.
• Bypassing the signature exposes an SQL injection, which is tedious to exploit manually in Burp Repeater but can be streamlined using automation tools like Kaido 0:24-0:32.
The video effectively demonstrates how a seemingly minor secret leak can completely undermine application security controls and lead to deeper system access.
Sources:
- 0:00-0:22 Overview of the White Rabbit machine and the initial exploit path
- 0:03-0:10 Uptime Kuma instance and status page discovery
- 0:12-0:18 Wiki documentation of the HMAC-secured GoFish webhook
- 0:19-0:22 Discovery of the leaked HMAC signing key
- 0:24-0:32 SQL injection discovery and tooling workflow with Kaido
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 1.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Penetration Testing. Commonly maps to: Security Assessment and Testing, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
What's going on YouTube? This is IPSC. We doing White Rabbit from Hack the Box, which starts out with finding an uptime Kuma instance, but we don't have any credentials. However, with some light recon, we discover a public status page that leads to other domain names. There's a wiki that talks about a web hook pipeline to go fish, and that signs the body of the request with HMAC to prevent any tampering. However, the signing key is leaked, so we can bypass the signing and find an SQL injection. It's a bit of a pain to do this mainly in the repeater window because you have to keep changing the signature every request, but I try out Kaido for this part since the workflow makes it pretty simple to automatically do this. And I mistakenly thought it was free, but I think my account was on some …