Easy Phish — HTB Writeup | The Hack Sparrow

Customers of secure-startup.com are getting hit with convincing phishing emails. Instead of chasing the phishing kit itself, the challenge asks a more useful question: why does spoofed mail from this domain sail through in the first place? The answer — and the flag, split in two — is sitting in plain sight in the domain's own SPF and DMARC DNS records.

Challenge overview

Field	Value
Platform	Hack The Box · Challenge
Category	OSINT / DNS
Difficulty	Easy
State	Retired
Target	`secure-startup.com`

Attack map

[Recon] secure-startup.com
      │
      ▼
[dig TXT] SPF record  →  "v=spf1 a mx ?all - HTB{RIP_SPF_Always_2nd"
      │
      ▼
[flag part 1] HTB{RIP_SPF_Always_2nd
      │
      ▼
[dig _dmarc TXT] DMARC record  →  "v=DMARC1;p=none;_F1ddl3_2_DMARC}"
      │
      ▼
[flag part 2] _F1ddl3_2_DMARC}
      │
      ▼
[FLAG] HTB{RIP_SPF_Always_2nd_F1ddl3_2_DMARC}

Los clientes de secure-startup.com están recibiendo emails de phishing muy convincentes. En vez de perseguir el kit de phishing en sí, el challenge plantea una pregunta más útil: ¿por qué el correo suplantado desde este dominio pasa sin problemas? La respuesta —y la flag, partida en dos— está a la vista en los propios registros DNS SPF y DMARC del dominio.

Ficha del challenge

Campo	Valor
Plataforma	Hack The Box · Challenge
Categoría	OSINT / DNS
Dificultad	Easy
Estado	Retirado
Objetivo	`secure-startup.com`

Mapa del ataque

[Recon] secure-startup.com
      │
      ▼
[dig TXT] registro SPF  →  "v=spf1 a mx ?all - HTB{RIP_SPF_Always_2nd"
      │
      ▼
[flag parte 1] HTB{RIP_SPF_Always_2nd
      │
      ▼
[dig _dmarc TXT] registro DMARC  →  "v=DMARC1;p=none;_F1ddl3_2_DMARC}"
      │
      ▼
[flag parte 2] _F1ddl3_2_DMARC}
      │
      ▼
[FLAG] HTB{RIP_SPF_Always_2nd_F1ddl3_2_DMARC}

🔒 Free account required

This is USER ACCESS content — free to unlock, no payment. The rest of the write-up (and everything else at this level) opens up once you're signed in.

Create a free account