DoxPit

Technical Walkthrough

Writeup

Challenge

• Name: DoxPit
• Category: Web
• Difficulty: Medium
• Mode: hybrid

Summary

DoxPit is a hybrid Web challenge with a public Next.js frontend and an internal Flask "AV" service. The solved chain was:

1. Abuse a vulnerable Next.js Server Actions redirect path to SSRF into the internal Flask service.
2. Use the internal /register route to create a token-bearing user.
3. Use that token against /home.
4. Trigger Jinja SSTI through the directory parameter and read the randomized /flag* path.

Artifact Inventory

Reference analysis/artifact-inventory.json and summarize the relevant files or remote surface.

Relevant artifacts:

• files/extracted/challenge/front-end/package.json: pins next to 14.1.0.
• files/extracted/challenge/front-end/app/serverActions.tsx: exports a server action that calls redirect("/error").
• files/extracted/challenge/av/application/blueprints/routes.py: exposes /register and token-authenticated /home.
• files/extracted/challenge/av/application/util/general.py: defines the weak blacklist for directory.
• files/extracted/entrypoint.sh: renames /flag.txt to /flag<10 hex>.txt.
• analysis/ssrf-register-nextaction-response.txt: live proof that the Next-Action request reached internal Flask /register.
• analysis/remote-solve-transcript.txt: sanitized execution transcript for the final solver run.

Analysis

The Next source and package metadata matched the Server Actions redirect SSRF class:

• next is 14.1.0.
• doRedirect() calls redirect("/error").
• The live root page exposed a $<secret redacted>... value for the action.

The browser-style form request only produced a normal redirect. The server-action request shape that worked was:

• POST /
• Host: <attacker tunnel host>
• Next-Action: <live action id>
• Content-Type: text/plain;charset=UTF-8
• body []

That returned the internal Flask registration response through the Next response, proving SSRF into <TARGET>:3000.

The Flask backend then supplied the second primitive. /register returns a token, and /home accepts either a logged-in Flask session or a valid token query parameter. /home rejects only a short blacklist in directory, then replaces {{ results.scanned_directory }} with the raw directory value before calling render_template_string(). That creates a Jinja SSTI sink.

The final payload avoided the blacklist by using Jinja statement delimiters, attr(), and generated underscores via format(95,95,95,95), then executed cat /flag* to handle the randomized filename.

Public research used:

• Assetnote advisory on <secret redacted>: https://www.assetnote.io/resources/research/advisory-next-js-ssrf-cve-2024-34351/
• Assetnote Server Actions SSRF background: https://www.assetnote.io/resources/research/digging-for-ssrf-in-nextjs-apps/

The public research was treated only as a lead. The exploit decision came from the provided source and the live SSRF proof.

Solve

The reproducible solver is solve/solve.py. It:

1. Fetches the live root page and extracts the server-action ID.
2. Starts a local HTTP redirect helper.
3. Uses a Cloudflare tunnel, or a supplied stable tunnel, as the attacker-controlled Host.
4. Sends the validated Next-Action request to SSRF into internal Flask /register.
5. Parses the returned token.
6. Sends a second SSRF request to the authenticated /home scan route with the returned bearer value and the encoded directory payload.
7. Writes only the flag candidate to the requested output file.

Final tracked execution used:

python3 scripts/challenge_exec.py Web/DoxPit -- python3 Web/DoxPit/solve/solve.py \
  --base-url http://<TARGET>:31944 \
  --tunnel-url https://unable-names-upgrades-flying.trycloudflare.com \
  --helper-port 8123 \
  --output Web/DoxPit/analysis/flag-candidate.txt \
  --transcript Web/DoxPit/analysis/remote-solve-transcript.txt

Then the harness captured the candidate into loot/flag.txt.

Flag

Raw flag is stored in loot/flag.txt and intentionally not reproduced here.

Lessons

• For source-backed Medium Web challenges, source audit plus one high-signal live validation is stronger than broad fuzzing.
• Next.js Server Actions requests are not always equivalent to browser form submissions; the Next-Action header and request body shape mattered here.
• Blacklists that block literal Jinja expression delimiters and attribute syntax can still be bypassed with statement delimiters plus dynamic attribute access.
• Randomized flag filenames should be read with a glob such as /flag* when the entrypoint proves the naming convention.

Source-Backed Dossier

The sections below are merged from companion Markdown notes for the same case. They are rendered after sanitization so the article stays precise without publishing raw flags, credentials, or target-specific secrets.

Notes

Scope

• Challenge: DoxPit
• Category: Web
• Difficulty: Medium
• Mode: hybrid
• Remote instance: <TARGET>:31944
• Start time: 2026-06-12T13:54:35Z
• Operator: harness
• State file: challenge-state.json

Harness Status

• Current phase: see challenge-state.json
• Next allowed actions: see next-action.json
• Raw flags and sensitive material stay in loot/ only. Do not paste them here.

Artifact Inventory

Evidence Ledger

Key Findings

-

RAG / Advisory Memory

RAG output is advisory only. Record evaluated retrievals with:

scripts/challenge_harness.py rag-record <workspace> --query "..." --tag MATCHED|PARTIAL|MISSING|<secret redacted>|GENERIC --validation "..."

Secrets/Flags

Raw flags and sensitive material stay in loot/ only. Use scripts/challenge_harness.py capture-flag to validate and record flag capture without printing the value.

Memory Summary

Metadata

• Platform: HackTheBox Challenges
• Category: Web
• Challenge: DoxPit
• Difficulty: Medium
• Source workspace: <local workspace>

Validated Solve Chain

Concepts only. Do not include raw flags, reusable credentials, tokens, cookies, private keys, or live secrets.

1.

Reusable Lessons

-

Dead Ends

-

Tool Quirks

-

Evidence Paths

-

Ingestion Decision

• Proposed for LightRAG: yes/no
• Requires user approval before ingestion: yes

Hypothesis Board

Keep no more than 3 active hypotheses on Easy/Medium and 5 on Hard unless the user explicitly asks for breadth.

Closed Branches