Skip to main content
CPEBuddy
HackTheBox - Alert

HackTheBox - Alert

Source: YouTube · IppSec · published Mar 22, 2025 · 41:59

Penetration Testing
No ratings yet Log in to rate
Transcript Available
Description

The Hack The Box machine "Alert" is an Easy difficulty target that primarily involves exploiting a Cross-Site Request Forgery (CSRF) vulnerability in a web application to achieve initial access 0:05.

Key Takeaways:
• The initial foothold requires identifying a CSRF vulnerability within a "Contact Us" form, which is facilitated by a Markdown converter feature 0:08.
• Attackers can use the Markdown converter to host malicious JavaScript, which is then triggered when a victim visits the contact page via their browser 0:22.
• Discovery of a "Messages" page is critical for further enumeration and understanding the application's structure 0:39.

Mastering web application vulnerabilities like CSRF is essential for successfully compromising modern web-based infrastructure.

Sources:

  • 0:05 Introduction to the Alert machine and its difficulty level.
  • 0:08 Explanation of the primary exploit vector involving CSRF.
  • 0:22 Details on using the Markdown converter for malicious JavaScript hosting.
  • 0:39 Discovery of the Messages page for further enumeration.

Generate CPE Credits

Generate a professional CPE document from this video's transcript.

Estimated credit: 0.5 CPE hours

Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.

Topic: Penetration Testing. Commonly maps to: Security Assessment and Testing, Security Operations. Exact CISSP domains are assigned during generation.

CISSP Domain Mapping
Learning Objectives
Self-Assessment Questions
PDF Export Ready

Free account. One generation at a time, with a daily limit.

CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.

Watch on YouTube

Transcript Preview

First 800 characters of the transcript

what's going on YouTube this is ipsec and we'll be doing alert from hack the box which the foot hold is probably a tad difficult for an easy machine as it requires enumerating a web app via cross-site request forgery however every critical piece of information needed to do this can be found multiple ways and I'll do my best to highlight them as we go through it first we discover there's a contact us page and when we submit a link to it a web browser immediately opens it up there's also a markdown converter that we can use to have the web server host some JavaScript so we can submit the uh page the markdown converter gives us to the contact us form and then control the target browser and when we point that browser at the homepage we discover there's a another page called messages and that h…