HackTheBox - BlockBlock
Source: YouTube · IppSec · published Mar 29, 2025 · 43:12
This video walks through the "Block" Hack The Box machine, focusing on exploiting a Web 3.0 chat application that relies on blockchain technology, where the main challenge is adapting to unfamiliar crypto and smart contract concepts 0:00-0:05.
Key Takeaways:
• The machine's difficulty stems less from complex exploitation and more from navigating new technologies like blockchain and cryptocurrency 0:08-0:18.
• The initial attack vector is a standard cross-site scripting (XSS) vulnerability found within a Web 3.0 chat application 0:21-0:27.
• After stealing the administrator's cookie via XSS, attackers must utilize a JSON RPC endpoint to enumerate the blockchain 0:27-0:33.
• The chat application's database is actually a Solidity smart contract; dumping it reveals additional credentials needed to pivot further into the machine 0:33-0:37.
This machine serves as an excellent practical introduction to Web 3.0 security testing by blending traditional web vulnerabilities like XSS with blockchain enumeration techniques.
Sources:
- 0:00-0:05 Introduction to the Block HTB machine
- 0:08-0:18 Discussion on the challenge of learning new blockchain/crypto tech
- 0:21-0:27 Identifying the XSS vulnerability in the Web 3.0 chat app
- 0:27-0:33 Using the JSON RPC endpoint to enumerate the blockchain
- 0:33-0:37 Dumping the Solidity smart contract database for credentials
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Penetration Testing. Commonly maps to: Security Assessment and Testing, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
what's going on YouTube this is IPC and today we'll be doing block block from hack the box which technically speaking isn't an incredibly hard machine but it uses a lot of new technologies so I think for most people the challenging aspect here is being able to pick up on new technologies as you go at least that was the case with me because this involves blockchain and crypto which are foreign Concepts to me anyways the box starts off with a web 3.0 chat application that's vulnerable to cross-site scripting which is kind of normal but once you get the administrator cookie you need to use some Json RPC endpoint in order to enumerate the blockchain and dump a solidity smart contract which is serving as the chat application's database and that gets you credentials to another user that lets you…