Hack the box invitation challenge

In this short article I will show you how to perform basic CTF by hack-the-box.

In order to sign up for the website, there is a short invite challenge that you need to complete and get the invite code. When you first go the website and click invite challenge in URL

https://www.hackthebox.eu/invite

In order to sign up you need an invitation code which need to be found. If you right click and inspect element you can view the source page of the website. There you can see a JavaScript which included in website. Right click inspect, you can see there is a javascript called /js/inviteapi.min.js

Now if you copy /js/inviteapi.min.js and add it in the main url it. Go to https://www.hackthebox.eu/js/inviteapi.min.js

You will see following page. Now, again right click on it and inspect page, you will see something interesting.

There is a JavaScript function called makeInviteCode. If you try that function in this page it will not work. But if you go to the main page which is

https://www.hackthebox.eu/invite and run that function in console. You will see following.

Here, we can see data which is

Data: Va beqre gb trarengr gur vaivgr pbqr, znxr n CBFG erdhrfg gb /ncv/vaivgr/trarengr\

Enctype: ROT13

This is not our invitation code, as we can see it is encrypted using ROT13. ROT13 stands for Rotation of Text 13 just Ceaser cipher where text is rotated by 13 characters.

You can decrypt it by going to following website and pasting the data.

https://rot13.com/

When you decrypt it, you are given message stating create a POST request to /api/invite/generate

Now, we modify the URL into following and perform POST request using CURL

https://www.hackthebox.eu/api/invite/generate

Which looks like this

After this we can see the code, but still we do not have the invitation code, as we can see its format is encoded.

SUxNQk8tVURGSE4tSUtKVlMtWk9GQkwtUUhCQ1c=

Format: encoded

From the encoding we can see that it is encoded using base64 encoding mechanism. How we know it,

Using following three ways:

1.      Length is multiple of 4 characters

2.      Every character is from A-Z, a-z, 0-9, +, /

3.      Padding at end is either 0,1 or 2 ‘=’ characters

In order to decrypt it, we go to following website and paste the code that we got from POST request.

https://www.base64decode.org/

When you run it you can see the code.

ILMBO-UDFHN-IKJVS-ZOFBL-QHBCW

Copy and paste the code into the main invitation URL which is

https://www.hackthebox.eu/invite

 You will be prompted with congratulation message and a sign-up page.

Note: If you want to bypass this hassle and just sign up, you can directly visit following URL. Above challenge is just for entertainment.

https://www.hackthebox.eu/register

Thanks