10. Those who hold this certification have. Low attack surface so I’ll skip to port 80. > BountyHunter(HTB)-Writeup. HackTheBox's Certified Bug Bounty Hunter #CBBH exam is truly one of a kind, from studying the modules provided on the Bug Bounty Job-Role Path you build a solid foundation of the. txt","path":"Raw. sudo nmap -p 22,80 -sV -sC -v bountyhunter. Resources. New SOC Analyst job-role path. Guided Hacking [Guided Hacking] DLL InjectorBlue was the first box I owned on HTB, on 8 November 2017. Worth checking back once in a while! A quick systeminfo command shows that this box is Server 2008 R2 without Hotfix (s). 1. Get admin session key using smuggling attack and leak his notes containing usernames and passwords. 声明：该公众号大部分文章来自作者日常学习笔记，也有少部分文章是经过原作者授权和其他公众号白名单转载，未经授权，严禁转载，如需转载，联系开白。 请勿利用文章内的相关技术从事非法测试，如因此产生的一切不良后果与文章作者和本公众号无关。Personal Blog. 1. BugBountyHunter is a training platform created by bug bounty hunter zseano designed to help you learn all about web application vulnerabilities and how get involved in bug bounties. viminfo. This DB credential is reused as a password for a user on the box. Become a Bug Bounty Hunter! 26 Aug, 2021. If we run powerup or do it manually, both ways doesn’t show the creds. STEP 1: nmap -sC -sV. Then we will use it to get the creds stored in `db. A 2020 report by HackerOne found that the average bounty paid for critical vulnerabilities stood at $3,650, and that the largest bounty paid to date for a single flaw was $100,000. In this case, I’ll use anonymous access to FTP that has it’s root in the webroot of the machine. 91 ( ) at 2021-05-30 11:05 EDT Nmap scan report for 10. Personal Blog. 10. Read stories about Bug Bounty Hunter on Medium. The web app has a portal where it has some details of a CVE records. So the reason is that the privesc creds are in registry. I can upload a webshell, and use it to get execution and then a shell on the machine. 100 and difficulty level Easy assigned by its maker. Find below the facts that differentiate HTB Certified Bug Bounty Hunter (HTB CBBH) from standard certifications: Continuous Evaluation – To be eligible to start the examination process, one must have completed all modules of the “Bug Bounty Hunter” job-role path 100% first. First, we start with a Nmap scan. Started my cybersecurity career in 2021 at ehackify as a student. BountyHunter is easy rated Linux box, hosted by Hackthebox, created by ejedev. CTF HackTheBox Pentesting BountyHunter(HTB)-Writeup. 68. 5 min read. Nothing to showpath is brutal and packed with amazing material. We use this alongside an LFI(local file inclusion) to get the password from the database. You can modify or distribute the theme without requiring any permission from the theme author. Guided Hacking [Guided Hacking] DLL InjectorLiability Notice: This theme is under MIT license. Worth checking back once in a while!A quick systeminfo command shows that this box is Server 2008 R2 without Hotfix (s). This module covers methods for exploiting command injections on both Linux and Windows. Posts; Cybersecurity. The Bug Bounty Hunter job-role path contains the underpinnings of each vulnerability/attack and multiple practical exercises to solidify your knowledge around the taught concepts and make you ready for the HTB Certified Bug Bounty Hunter (HTB. This machine requires you to exploit a web-based XML vulnerability via XXE and then perform a Python source code analysis for the privilege escalation part. So in this blog, we are going for bounty hunter hack the box machine and we’ll take over the user flag and root flag of the machine… so first turn and on your hack the box VPN and load the IP address on your browser which is 10. Follow. github","contentType":"directory"},{"name":"chaoss-groups","path":"chaoss. So let’s get started and take a deep dive into disassembling this machine utilizing the methods outlined below. Forgebreaker / HTB_Bug_Bounty_Hunter Public. 4. 8: Getting into the world of bug bounty hunting without any prior experience can be a daunting task, though. If you have seen my previous post below regarding the Broken Access Control Vulnerability in Confluence Data Center, and you are curious about how it…R4fik1-HTB_broken_authentication_Repository. Let’s see what’s in store! As always, we start with a full nmap scan. 143 -F -Pn PORT STATE SERVICE 22/tcp open ssh 80/tcp open 443/tcp open closer look at these ports. 10. Awesome! Thanks! Is the question should be CPTS and OSCP then CBBH and OSWA? Not for me, I just finished OSCP , now doing OWSP and then CBBH. main. They can also think outside the box, chain multiple vulnerabilities to showcase maximum impact, and. Bounty Hunter - Early Access. Login to HTB Academy and continue levelling up your cybsersecurity skills. . In this video walk-through, we covered a demo of XML External Entity Injection along with privilege escalation through exploiting Python eval function. com. Posts; Cybersecurity. Posts; Cybersecurity. It’s a very easy Windows box, vulnerable to two SMB bugs that are easily exploited. I have been a partner at HackTheBox, a leading online platform for cybersecurity training and testing, since September 2023. The Bug Bounty Hunter job-role path contains a mix of theory and interactive exercises that will prepare you for the HTB CBBH. profile user. I've already decided I'm going to do the CBBH but need to set some time expectations so I can plan accordingly, thx. Then I’ll access files in an encrypted zip archive using a known plaintext attack and bkcrypt. Find the offset using the value of EIP: msf-pattern_offset -q 'b7Ab'. 10. We know that cybersecurity is a fast and ever-evolving industry: our labs and modules are constantly updated following the latest trends and techniques. I learned about XXE, XML parsing, and HTML injection during the test. To be specific change actionban parameter, so that it executes command when banning specific ip. Posts; Cybersecurity. I have been working hard lately on my web application hacking skills, so I took the challenge to enroll myself into Hack The Box's newly released certificate "Certified Bug Bounty Hunter (CBBH. Then we might need to create different password list using names combinations. In this writeup, I have demonstrated step-by-step how I rooted BountyHunter HackTheBox machine. I’ve tried navigating to "Network" tab to view the action of this page when I…Code breakdown: load_file checks whether the file extension is . So, you can use it for non-commercial, commercial, or private uses. > c:\inetpub. However, for non-students, the training program costs $145. htbapibot July 24, 2021, 3:00pm #1. Posts; Cybersecurity. PS C:\users\merlin\Desktop> systeminfo Host Name: BOUNTY. . 10. Type help for list of commands # help open {host,port=445} - opens a SMB connection against the target host/port login {domain/username,passwd} - logs into the current SMB connection, no parameters for NULL connection. HTB CBBH | Bug Bounty Hunter Certification by Hack The Box Academy. Root is obtained through a python sandbox escape from a custom script with NOPASSWD sudo access. Nmap scan report for 10. Nmap Scan Starting with Nmap scan i prefer doing all port scan first and then doing service enumeration scan on the targeted ports. Introducing the first Hack The Box Academy certification: Certified Bug Bounty Hunter aka HTB CBBH! 🕷️Read more 👉 main domains & 20. (note db. 231 2 Host discovery disabled (-Pn). 220 ProFTPD Server (Debian) [::ffff:10. Interestingly, there’s an field. Let’s access the bkcrack directory and let’s see inside the directory. They can also think outside the box, chain. We see the offset is equal to 52. Monitors - [HTB]A community for discussing all things eLearnSecurity! Talk about courses and certifications including eJPT, eCPPT, etc. Based on the Apache version the host is likely running Ubuntu 20. They also want your money, but they have a good reputation. BountyHunter - [HTB] BountyHunter is an easy linux machine from HackTheBox where the attacker will have to find. [~/HTB/BountyHunter] └─$ sudo nmap -sC -sV -p- 10. 10. Then run binary by inputing the pattern. 116 rightprotoport =tcp ike =3des-sha1-modp1024! esp =3des-sha1! # This file holds shared secrets or RSA private keys for authentication. 5 MACHINE RATING 16746 USER OWNS 15571 SYSTEM OWNS 24/07/2021 RELEASED Created by ejedev Copy Link Play Machine Machine Synopsis BountyHunter is an easy Linux machine that uses XML external entity injection to read system files. htb@metapress. Doing sudo -l we can run the following python script as root using python 3. Established in 2017, Bountie Hunter is a Gaming & Metaverse Accelerator. BountyHunter allows people to set bounties on people (ex. The first bit is to start up that php development server. 4. HTB Certified Bug Bounty. Many Git commands accept both tag and branch names, so creating this branch may cause unexpected behavior. Personal Blog. png. . Guided Hacking [Guided Hacking] DLL InjectorLiability Notice: This theme is under MIT license. Aside from work stuff, I like hiking and exploring new places. My style of writeups is to describe how I was thinking when attacking them. list - p users . {"payload":{"allShortcutsEnabled":false,"fileTree":{"":{"items":[{"name":". HTB Certified Bug Bounty Hunter (HTB CBBH) is a highly hands-on certification that assesses the candidates’ bug bounty hunting and web application pentesting skills. HTB Certified Bug Bounty Hunter (HTB CBBH) is a highly hands-on certification that assesses the candidates’ bug bounty hunting and web application pentesting skills. This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository. Personal Blog. I was looking at the CBBH but I could not find any information about how the exam is actually looking alike. I’ll start with a webserver that isn’t hosting much of a site, but is leaking that it’s running a dev version of PHP. Could anybody enlighten me about: Timeframe? How many machines / Apps?. Guided Hacking [Guided Hacking] DLL InjectorRole paths are a series of modules that have been hand-curated and ordered by HTB, and our tied to our various HTB Certifications. Guided Hacking [Guided Hacking] DLL InjectorAnother one of the first boxes on HTB, and another simple beginner Windows target. We find our inputs on a test form are encoded and passed to a backend script, but on closer. I’ll add that to my local /etc/hosts file, and I’ll use wfuzz to look for subdomains. OS Name: Microsoft Windows Server 2008 R2 Datacenter. So, you can use it for non-commercial, commercial, or private uses. Guided Hacking [Guided Hacking] DLL InjectorGet started with hacking in the academy, test your skills against boxes and challenges or chat about infosec with others | 225717 membersBountyHunter HackTheBox Walkthrough. Guided Hacking [Guided Hacking] DLL InjectorPersonal Blog. Guided Hacking [Guided Hacking] DLL InjectorHTB Certified Bug Bounty Hunter (HTB CBBH) is a highly hands-on certification that assesses the candidates’ bug bounty hunting and web application pentesting skills. Jan 04. Now, there is only a web app running. 25 Jul, 2023. This is BountyHunter HackTheBox machine walkthrough. PS C:usersmerlinDesktop> systeminfo Host Name: BOUNTY. The Bug Bounty Hunter job-role path contains the underpinnings of each vulnerability/attack and multiple practical exercises to solidify your knowledge around the taught concepts and make you ready for the HTB Certified Bug Bounty Hunter (HTB CBBH) exam. Portswigger + pentesterlab should be enough. Here to enable and serve revenue cybersecurity practitioners - 3x Enablement Leader l ex-Deloitte #TheEnablementDude #TheEnablementHacker #EnablementHacks #TheGreekEnablementGuy{"payload":{"allShortcutsEnabled":false,"fileTree":{"":{"items":[{"name":". -f to specify the format for the shell, in this case, exe. 4. You can modify or distribute the theme without requiring any permission from the theme author. 26s latency). Feb 21, 2019. Today we are going to solve another CTF challenge “Bounty”. HTB [BountyHunter] Jan 27, 2023 Jopraveen Jan 27, 2023 Jopraveen BountyHunter is an easy machine from HackTheBox, which involves XXE for the foothold. Hack the box academy presento su nuevo certificado "HTB Certified Bug Bounty Hunter (HTB CBBH)" orientado a entry level y juniors en el…See who you know in common. Our first goal is to use some inline java to pop a notice on a PHP server we're going to be running. Login with a user on Gitea and one of the repo was leaking private key for a user and AWS credentials. 58 Starting Nmap 7. ago. The Course. Saturday, August 5, 2023. obsidian","path":". I’ll start the scan and immediately kill it, noting that the. So, you can use it for non-commercial, commercial, or private uses. Starting off I scanned the box We see port 80 is open, so we navigate to the page to see this:. The box also has an internal python3 script which could be run as elevated privileges. Posts; Cybersecurity. exe. Each Role Path has a corresponding. A quick initial scan discloses web services running on ports 80 and 443, as well as an SSH server running on port 22: ~ nmap 10. So let’s test it: python3 -c 'print ("A" * 52 + "BBBB")'. HTB Certified Bug Bounty Hunter (HTB CBBH) is a highly hands-on certification that assesses the candidates’ bug bounty hunting and web application pentesting skills. Hello. Reward: +500. Please do not post any spoilers or big hints. ![01]: AMD64 Family 23 Model 49 Stepping 0 AuthenticAMD ~2994 Mhz BIOS Version: Phoenix Technologies LTD 6. . 85. [Lines 6-8] Get the length of the hex string. 10. {"payload":{"allShortcutsEnabled":false,"fileTree":{"":{"items":[{"name":". Before starting let us know something about this box. Summary. Liability Notice: This theme is under MIT license. Official discussion thread for BountyHunter. Posts; Cybersecurity. Check EIP register. HTB Certified Bug Bounty Hunter (HTB CBBH) is a highly hands-on certification that assesses the candidates’ bug bounty hunting and web application pentesting skills. We tried to list . Hack The Box certifications and certificates of completion do not expire. Enumerating the webserver took me quite some time but eventually, I used grep to search for a login function in /srv/prod: grep -iR "login(" This command returned multiple results but 15 matches are way less than the amount of results I got with my. Use this platform to apply what you are learning. This is a Windows host that is vulnerable to Remote Code Execution by bypassing the web server’s file executable extension blacklist. . This is Bounty HackTheBox machine walkthrough and is also the 22nd machine of our OSCP like HTB boxes series. Certified Bug Bounty Hunter exam. Bektur Umarbaev. {"payload":{"allShortcutsEnabled":false,"fileTree":{"bountyhunter":{"items":[{"name":"bountyhunter_web-1. 2. . Launching HTB CDSA: Certified Defensive Security Analyst. h3x6 • 2 mo. 11. About. 93 and difficulty easy assigned by its maker. exe. Nmap scan. Not shown: 65533 closed ports PORT STATE SERVICE. 11. we use the user development extracted from /etc/passwd along with the password m19RoAU0hP41A1sTsq6K to connect via SSH and succeed. . All addresses will be marked 'up' and scan times will be slower. 4. keep going htb, your modules are so helpfulPersonal Blog. 5. They will be able to spot security issues and identify avenues of exploitation that may not be immediately apparent from searching for CVEs or known exploit PoCs. Posts; Cybersecurity. For the root part, there is an internal tool for ticket validation which can be exploited by leveraging the Python eval function to pops a root shell. This module will also teach how to patch command injection vulnerabilities with examples of secure code. Guided Hacking [Guided Hacking] DLL InjectorA deep understanding of AD enumeration techniques and tools is essential to becoming a well-rounded information security professional. This module covers common vulnerabilities and misconfigurations regarding Authentication that could be leveraged to gain unauthorized access to a web application. LinkedIn is the world’s largest business network, helping professionals like Mohit Sam discover inside connections to recommended job candidates, industry experts, and business partners. HTB [BountyHunter] Jan 27, 2023 Jopraveen Jan 27, 2023 Jopraveen BountyHunter is an easy machine from HackTheBox, which involves XXE for the foothold to read local files. 10. 7600 N/A Build 7600. The Bug Bounty Hunter path has 20 modules, with 257 sections. Bounty Hunters is a Third Person Shooter set in a Cyberpunk themed city. Posts; Cybersecurity. 20 Modules. There’s. initial 10. Nov 28, 2021 • 16 min read In this technical walkthrough, I will go over the steps of how I completed the HackTheBox BountyHunter challenge! I must admit, I only have a few words to say about it–it's a nice and easy BOX. They will also be able to assess the risk at which a web application, service, or API is exposed and compose a commercial-grade as well as actionable report. BountyHunter is a retired box available on Hack The Box. BountyHunter is an easy Linux machine that uses XML external entity injection to read system files. 1 Like. Guided Hacking [Guided Hacking] DLL InjectorContribute to python4004/BountyHunter-HTB development by creating an account on GitHub. You can modify or distribute the theme without requiring any permission from the theme author. They will be able to spot security issues and identify avenues of exploitation that may not be immediately apparent from searching for CVEs or known exploit PoCs. Complete the Bug Bounty Hunter job-role path 100%. The question that's more challenging - I feel - is whether or not you need to follow-up the training with acquiring the certification. This allows me to see what l is currently. All we need to do is rename the file and execute it! > ren c:\inetpub\payload. Required: 2500. Hussain has 1 job listed on their profile. It is a Linux OS box with IP address 10. Guided Hacking [Guided Hacking] DLL InjectorThis article will be dedicated to the walkthrough of the BountyHunter box (level easy) available in HackTheBox. Personal Blog. Search ⌃ K. 100. If you've been looking for a hands-on bug bounty hunting certification, then look no further than the Certified Bug Bounty Hunter (CBBH) from HackTheBox!Hack. Nothing to showHTB easy machine. Posts; Cybersecurity. In order to take the certification exam, individuals are required to purchase the accompanying training program. The screenshot above shows the manual of the tools{"payload":{"allShortcutsEnabled":false,"fileTree":{"":{"items":[{"name":". Pretty. Begin participating from the comfort of your own home. This is a much more realistic approach. You can modify or distribute the theme without requiring any permission from the theme author. Posts; Cybersecurity. Port 80. LPORT to specify the local port to connect to. When we click on "here"→ this will lead us to another page. txt 10. User for this box incorporates XML XXE in a bug reporting forum and using that exploit to read a discovered database. obsidian","contentType":"directory"},{"name":"Attachments","path. $100000) so they (and maybe some other players) will be attacked by other players that want the money. OS Version: 6. Now let's cut to the chase and get started! Run an nmap scan: Behind The Scenes — HTB Reverse Engineering We are given a file behindthescenes and we are given the task to recover the flag. The type of attack will be "Sniper", the position of the payload will be the extension of the file uploaded in the previous step of the "filename" parameter. 10. ·. About. Guided Hacking [Guided Hacking] DLL InjectorThe top 1% of big bounty hunters make about $35000 a year, so if you’re in the very top percentile, you could potentially make a living - but a very difficult one, if you’re still learning. The study also found that at least 50 hackers. 3. Guided Hacking [Guided Hacking] DLL InjectorHigh school teacher here, looking for any suggestions for labs I could set up on some older PCs where students can actually see and experience what they are doing. HTB Academy Web Modules for CBBH. It's all about effectiveness and professionally communicating your findings. You can modify or distribute the theme without requiring any permission from the theme author. You can modify or distribute the theme without requiring any permission from the theme author. Hack The Box Certifications. HTB Content Machines. HTB Certified Bug Bounty Hunter certification holders will possess technical competency in the bug bounty hunting and web application penetration testing. The skills obtained from hacking this box are XXE. So, you can use it for non-commercial, commercial, or private uses. ago. 10. {: . Notes from HackTheBox's Certified Bug Bounty Hunter Pathway. For me, i need to extract the tool manually for some reason. exe” to the end of that file name. BountyHunter (HTB) 0xFK 134 subscribers Subscribe 8 Share 826 views 1 year ago Another interesting machine by ejedev published on the HackTheBox Detailed writeup is here. Posts; Cybersecurity. hackthebox htb-bounty ctf upload. Check EIP register. Privesc: merlin –> SYSTEM. Welcome to the writeup of the bountyhunter machine of the Hack The Box platform. April 22, 2021 by thehackerish. Here are the resutlts: Nmap scan report for 10. You can modify or distribute the theme without requiring any permission from the theme author. development@bountyhunter: ~ $ ls -a . BountyHunter - [HTB] BountyHunter is an easy linux machine from HackTheBox where the attacker will have to find. md or not. Use what you can to get the job done. Nov 13, 2021. Posts; Cybersecurity. The "Student Sub" for HTB. First, I’ll bypass a login screen by playing with the request and type juggling. In addition, those select bug bounty hunters who have earned rewards surpassing $1 million also skew the average. github","path":". If you are uncomfortable with spoilers, please stop reading now. Hack The Box introduces Bug Bounty Hunter Certification aka CBBH! More details here: #HackTheBox #CyberSecurity #BugBounty. txt . ; reads the string below “__Ticket Code:__”, removes (**) and thereafter assigns the number before the (+) operator asticketCode. My thoughts. php. It primarily covers web application related content as opposed to other pen testing paths which may include operating system or network content. Luckily! There’s a Binary file that we can use over here. View Hussain Maharaz Yusuf’s profile on LinkedIn, the world’s largest professional community. The TCP 3000 port is claiming to be hadoop, which is a big data storage solution. Guided Hacking [Guided Hacking] DLL InjectorPersonal Blog. Horizonatll was built around vulnerabilities in two web frameworks. So we might try password spraying using crackmapexec. In order to take the certification exam, individuals are required to purchase the accompanying training program. Could not load tags. HTB Certified Bug Bounty Hunter (HTB CBBH) is a highly hands-on certification that assesses the candidates’ bug bounty hunting and web application pentesting skills. It helps me to improve my confidence and started pawn HTB boxes and Now focused to create a good career in the security field. Investigating a bit more through the web page, we find log_submit. {"payload":{"allShortcutsEnabled":false,"fileTree":{"":{"items":[{"name":". Introducing the first Hack The Box Academy certification: Certified Bug Bounty Hunter aka HTB CBBH! 🕷️Read more 👉 main domains & 20. Posts; Cybersecurity. 00, 12/12/2018 Windows Directory: C:Windows System Directory: C:Windowssystem32 Boot Device: DeviceHarddiskVolume1 System Locale: el;Greek Input Locale: en-us;English (United States) Time Zone: (UTC+02:00). The new easy ranked machine on hack-the-box platform is called Bounty-Hunter so let’s try solving it and see what is going in there It was a simple web page the portal button was the only eye catcher…#htb #hackthebox #bug #bugbounty #bountyhunter #walkthrough Hello guys,This is Sudhakar. While you are trying. Being able to read a PHP file where credentials are leaked gives the opportunity to get a foothold on system as development user. From the output, we notice an interesting file db. github","contentType":"directory"},{"name":"chaoss-groups","path":"chaoss. The first thing I did was start some recon with ffuf. Matthew Bach. Become a Bug Bounty Hunter! The HTB BB path does exploitation and covers a few vulns. Chaining the Windows trusted binary, FodHelper, for UAC bypass together with the ability to rewrite registry keys will safely disable ASMI allowing a PowerShell reverse shell. Personal Blog. 1. Marmeus November 20, 2021. July 28, 2021 Posted by Anand Jayaprakash 3. Marmeus October 16, 2021. 5. [Line 4] If the OS string contains “windows”, append “. HTB: HTB, on the other hand, is vendor agnostic. Guided Hacking [Guided Hacking] DLL InjectorLiability Notice: This theme is under MIT license. The cost of the Bug Bounty Hunter (BBH) certification exam from Hack The Box (HTB) is $210, inclusive of taxes. HTB Certified Bug Bounty Hunter certification holders will possess technical competency in the bug bounty hunting and web application penetration testing domains at an. HTB: Bounty. Learn how to test for security vulnerabilities on web applications and learn all about bug bounties and how to get started. BountyHunter is an easy Linux box created by ejedev for Hack The Box and was released on the 24th of July 2021. Hancliffe — User Enumeration Nmap reveals three open ports, two of them are HTTP and one is unknown port but an application is running on it and it is asking for username and password. So, you can use it for non-commercial, commercial, or private uses. 10. Personal Blog. {"payload":{"allShortcutsEnabled":false,"fileTree":{"BountyHunter":{"items":[{"name":"Bounty-Hunter","path":"BountyHunter/Bounty-Hunter","contentType":"directory. It is a retired vulnerable lab presented by Hack the Box for helping pentester’s to perform online penetration testing according to your experience level; they have a collection of vulnerable labs as challenges, from beginners to Expert level. Personal Blog. That’s typically set in an environment variable. 0 Build 17763 x64. HTB Certified Bug Bounty Hunter (HTB CBBH) is a highly hands-on certification that assesses the candidates’ bug bounty hunting and web application pentesting skills. See full list on 0xdf. A. Personal Blog. Posts; Cybersecurity. txt Hey team, I'll be out of the office this week but please make sure that our contract with Skytrain Inc gets completed. Anyone attacking a web app will be using Burp or OWASP Zap, though. Personal Blog. png","path":"proof1. Finally we exploit a script used to process train tickets. It is a machine now “retired”, from which I got the user and system flags some months ago (October 2021) when it was still active. From understanding Bash prompt descriptions and system information to efficiently editing files and employing regular expressions, each topic is designed to bolster your confidence in tackling real-world cybersecurity challenges. Liability Notice: This theme is under MIT license. Introduction. 58 Starting Nmap 7. Get certified for. . Posts; Cybersecurity. Apr 2 -- BountyHunter is an easy Linux box created by ejedev for Hack The Box and was released on the 24th of July 2021. Assess the web application and use a variety of techniques to gain remote code execution and find a flag in the / root directory of the file system. Hack The Box Certified Bug Bounty Hunter (HTB CBBH)! Thank you Dimitrios Bougioukas, Zeyad AlMadani, Ben R. [Write up] HTB: BountyHunter – Khai thác lỗ hổng XXE. ENUMERATION : First, we going to take the Nmap scan using the below command. They will be able to spot security issues and identify avenues of exploitation that may not be immediately apparent from searching for CVEs or known exploit PoCs.