root@thehacksparrow:~/writeups$ SYSTEM ONLINE
· log in sign up
← back to HackTheBox writeups
root@sparrow:~/writeups$ cat flag-command.md
// writeups

Flag Command

31 May 2024 · 2 min read
writeupshacktheboxchallengeVery Easycat-webretired
Flag Command — HTB challenge
A terminal-style web "game" keeps its logic in the frontend. The command list — including a secret one — travels in an API response you can read straight from DevTools.

Challenge overview

FieldValue
PlatformHack The Box · Challenge
CategoryWeb
DifficultyVery Easy
StateRetired

Attack map

[Web /] terminal-style game
      │
      ▼
[DevTools ▸ Network] /api/options
      │
      ▼
[JSON] secret command
      │
      ▼
[FLAG]

1. Recon the application

The UI mimics a terminal with a limited command set (start, help…). It's not a real game — it's JavaScript deciding what's accepted.
help
> start  clear  audio  restart  info

2. Rule out command injection

Trying classic payloads confirms there's no arbitrary execution: only predefined commands are accepted, so the flaw is in the client logic, not the server.
$(whoami)
> You do realise its not a park...

3. Inspect traffic with DevTools

The Network tab shows every request the page makes on load. That's where the endpoint feeding the game shows up.
# F12 ▸ Network ▸ recargar (F5)
GET /api/options

4. Read the API endpoint

The endpoint returns the full command JSON, including a secret key with the magic phrase and the flag.
curl -s http://TARGET/api/options
{
  "commands": [ ... ],
  "secret": [
    "Blip-blop, in a pickle with a hiccup! Shmiggity-shmack",
    "HTB{D3v3l0p3r_t00l5_4r3_b35t__t00l5_wh4t_d0_y0u_Th1nk??}"
  ]
}

5. Run the secret command

Blip-blop, in a pickle with a hiccup! Shmiggity-shmack
> HTB{D3v3l0p3r_t00l5_4r3_b35t__t00l5_wh4t_d0_y0u_Th1nk??}

Chain summary

PhaseComponentWeaknessImpact
ReconFrontend JSGame logic client-sideCommands controlled by JS
Leak/api/optionsSensitive data in APISecret command + flag exposed

Lessons learned

  • The frontend is never a security boundary — anything that reaches the browser is visible.
  • Don't ship sensitive data in API endpoints assuming "nobody will look".
  • DevTools (Network/Sources) is the first stop in any web challenge.