HackTheBox - Imagery
Source: YouTube · IppSec · published Jan 24, 2026 · 45:07
The video demonstrates an exploit chain starting with XSS and cookie theft to access an administrative file disclosure vulnerability, ultimately leading to Remote Code Execution (RCE) on a Python Flask application 0:06.
Key Takeaways:
• The initial vector is a Cross-Site Scripting (XSS) vulnerability where the session cookie lacks the HTTP-only flag, allowing attackers to steal cookies and gain admin access 0:08.
• Reconnaissance is critical; much of the vulnerable page is loaded client-side via JavaScript, allowing the attacker to inspect the vulnerable code before even logging in 0:24.
• Once admin access is obtained, a file disclosure vulnerability allows the download of the application's source code 0:18.
• Analyzing the downloaded source code reveals additional bugs that facilitate the final step of achieving Remote Code Execution (RCE) 0:30.
This walkthrough highlights that effective exploitation often relies more on deep reconnaissance and understanding client-side code than on the exploits themselves.
Sources:
- 0:06 Introduction to the Hack the Box challenge involving a Python Flask website.
- 0:08 Explanation of the XSS vulnerability and missing HTTP-only flag on session cookies.
- 0:18 Discovery of the file disclosure vulnerability in the admin section.
- 0:24 Insight into client-side JavaScript loading and pre-login reconnaissance.
- 0:30 Using source code to find the final bug leading to RCE.
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 1 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Penetration Testing. Commonly maps to: Security Assessment and Testing, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
What's going on, YouTube? This is IPS, and today we'll be doing imagery from Hack the Box, which starts off with a few exploits against a website running Python Flask. First, we find a cross-ite scripting vulnerability, and the session cookie doesn't have HTTP only set. So, we can steal cookies off the website that gets us into the administrative section of the website, which has a file disclosure vulnerability. Now, the cool part here wasn't the exploit chain. There's some recon that I think a lot of people miss. Much of this page is loaded client side with JavaScript. So we can actually see the code that is vulnerable to cross-ite scripting before even logging in. Anyways, the file disclosure lets us download the source code to find another bug that leads to remote code execution. Once w…