TwoMillion HTB

TwoMillion HTB Nmap scanning Analyzing the Nmap scans port service ssh ngnix Adding the domain name to the hosts file ##Enumerating the port 80 Visting the http://2million.htb on browser we have a site and its looking legacy hackthbox platform. we have a jion button there when i cliked on it its asking the invite code but we dont have invite code on checking viewpagesource : on clicking /js/inviteapi.min.js it reavled this code which tells whether the invide code is valid or not. open inscpet tab and go to console and type their allow pasting and trigger the flow with makeInviteCode(); we have a hint there , and we the cipher too it is ROT13 encrypted text : Va beqre gb trarengr gur vaivgr pbqr, znxr n CBFG erdhrfg gb /ncv/i1/vaivgr/trarengr after decyrotion w e have In order to generate the invite code, make a POST request to /api/v1/invite/generate sending the post request we have again a encypted code : MDZSNVYtUDlJWkUtOEhOVlctWThJRTE=. looks like base64 decrypting it we have the invite code lets create the account. we have sucesfully logged in to the site ```