HackTheBox - Cat
Source: YouTube · IppSec · published Jul 5, 2025 · 1:04:52
The "Cat" Hack The Box machine demonstrates bypassing XSS filters to steal an admin cookie, exploiting SQLite injection for initial access, and leveraging a Git server vulnerability for privilege escalation to root.
Key Takeaways:
• The web app lacks the HttpOnly cookie flag, allowing XSS via username registration or form submission bypass to steal an admin session 0:06.
• Exposed source code via the /get endpoint enables discovery of an SQLite injection vulnerability in the 'accept_cat' functionality 0:28.
• The injection is exploited using SQLMap or manual SQLite RCE to write a web shell and obtain a reverse shell 0:36.
• Post-exploitation reveals a vulnerable Git server where stored XSS and CSRF leak source code containing root credentials 0:43.
This walkthrough highlights the critical chain of vulnerabilities from input validation failures to system compromise.
Sources:
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 1 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Penetration Testing. Commonly maps to: Security Assessment and Testing, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
What's going on YouTube? This is IPSC and we're doing cat from hack the box which is a really great box for some cross-ite scripting practice. It starts off with a custom web app that doesn't have HTTP only set on the cookies and there's two ways we can trigger the cross-ite scripting. Either through a submission on a form which has some filters we have to bypass or if we sign up with an XSS payload and our username we can bypass the filter altogether. This gets us an administrator cookie which we can perform an SQLite injection. The website does have.get get exposed. So we can pull the source code and then scan it with open grip or sneak to find that vulnerability which we'll exploit with two ways. Once with SQL map and the other manually by abusing the SQL light injection to write a web …