Skip to main content
CPEBuddy
HackTheBox - Sorcery

HackTheBox - Sorcery

Source: YouTube · IppSec · published Apr 25, 2026 · 3:03:05

Cybersecurity
No ratings yet Log in to rate
Transcript Available
Description

BLUF: This video demonstrates a complex Hack the Box machine named "Sorcery," focusing on cipher injection, cross-site scripting, and the forging of WebAuthn (Passkey) credentials to gain administrative access. 0:00

Key Takeaways:
• The challenge begins with cipher injection, which serves as the initial entry point for exploitation. 0:11
• Attackers leverage cross-site scripting (XSS) to hijack the admin user's browser session. 0:16
• Due to the minimal web app interface, cross-site request forgery (CSRF) vectors are limited. 0:21
• The core complexity involves forging a WebAuthn (Passkey) token to authenticate as the admin. 0:28
• Successful forgery allows the attacker to add their own public key and log in as the target user. 0:32

The summary highlights the intricate steps required to bypass modern authentication mechanisms in CTF environments.

Sources:

  • 0:00 Introduction to the "Sorcery" Hack the Box machine.
  • 0:11 Discussion of cipher injection as the starting point.
  • 0:16 Exploitation of cross-site scripting against the admin.
  • 0:28 Explanation of Passkey/WebAuthn authentication.
  • 0:32 Forging Passkeys to gain user access.

Generate CPE Credits

Generate a professional CPE document from this video's transcript.

Estimated credit: 2 CPE hours

Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.

Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.

CISSP Domain Mapping
Learning Objectives
Self-Assessment Questions
PDF Export Ready

Free account. One generation at a time, with a daily limit.

CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.

Watch on YouTube

Transcript Preview

First 800 characters of the transcript

What's going on, YouTube? This is Ipsac, and today we'll be doing Sorcery from Hack the Box. And there's too much to summarize here in this intro. I feel like it has at least 20 steps, but my favorite by far is the beginning of this box. It starts off with cipher injection, which I just find fun to do. That eventually leads us to a place where we have cross-sight scripting on the admin user and can take control of their browser. The web app is pretty minimal, so there isn't a lot of places to attack with cross-sight request forgery. However, it does support pass key login, which is a newer way websites authenticate. We'll do a lot of what feels like magic here to forge a Pasi, add it to their account, and then log in as that user. After that, there's still a lot to do on this box and hopef…