I'M PRETTY BORED.

@evanafterfree

6.6K followers · usually 1.8K views a post

Views

97.7K

Likes

4.5K

Comments

103

SoundTikTok sound · original sound - san12345678910

Why it worked

The video demonstrates a practical hacking technique by inspecting network requests and manipulating client-side validation, which is a common vulnerability. The clear, step-by-step process and the successful outcome make it engaging for viewers interested in cybersecurity and problem-solving.

Summary

The creator attempts to solve a web security challenge by bypassing a combination lock on a website. Initially, they try brute-forcing combinations, but then inspect the network requests to understand the validation process. By manipulating the client-side request and adding the correct content-type header, they successfully obtain the flag and complete the challenge.

Structure

1Boredom and desire to hack
2Accessing the challenge and initial attempts
3Inspecting network requests and understanding client-side validation
4Manipulating the request with correct headers
5Obtaining the flag and completing the challenge
6Reflecting on the client-side validation bypass

On-screen text

I'M PRETTY BORED. SOME SHIT. WE ARE ON RANGE ON WEBSITE. JAVA SHOP. IT IS ONE 100 POINTS. THE CONTAINER. READS: "MY FAVORITE COFFEE A NEW WEBSITE, IT BEHIND A LOCK PAGE. THE PAGE TO GET ACCESS ACTUALLY OPEN PRIVATE HERE'S THE WEB A COMBINATION LOCK. IT WILL.... NOW LET'S TAKE WE'RE GONNA AND WE'RE ACCESS DENIED. AND OVER HERE POST REQUEST TO CHECK COMBINATION. THE DATA THAT WE COPIED EARLIER. VALUE. GO TO THE DISTRO. CURL DASH X AND THEN POST WE'RE USING. THE ENDPOINT GONNA USE A LOWERCASE D FOR DATA. BROWSER, CLICK RAW ON THE STATUS OR ON THE PAYLOAD WE'RE GONNA COPY THIS LINE BACK WE'RE GONNA PASTE WE ARE JUST GONNA CHANGE EVERY LOCKED TO OPEN AND WE'RE GONNA SEE WHAT HAPPENS. AN UNSUPPORTED WHICH MEANS I NEED TO MODIFY ALRIGHT, SO WE SEND THAT COMMAND. AND WE GOT AN ERROR DID LOAD JSON DATA BECAUSE THE CONTENT TYPE APPLICATION SLASH JSON. SO THAT MEANS TO ADD A HEADER OF CONTENT TYPE APPLICATION SLASH JSON. AS A MIME AND IT TELLS THE SERVER DATA IT'S EXPECTING TO RECEIVE FROM NOW ONE MORE THE BROWSER REQUEST THAT THE SERVER COULD NOT UNDERSTAND. AND I THINK I JUST NEED TO ADD SINGLE QUOTES AROUND AND HERE WE A FLAG. BACK ON SKILLBIT ARE DONE. THAT I WOULD ONE ACTUALLY NEED TO COMBINATION TO BYPASS IT. WE JUST USED THE CLIENT SIDE AGAINST ITSELF. AND WE SENT WE NEVER EVEN SERVER, HEY, KNOWS THE CODE, AND EACH ONE OPEN. SEND IT. CLIENT SIDE VALIDATION IS NO VALIDATION.

Original caption

can you think of another way to bypass this combination lock? #security #Tech #hacking #webapp

Transcript

I'm pretty bored. Let's hack some shit. Another one. We are on range on skillbit's website. We're doing cracking the Java shop. It is one question, 100 points. Let's spawn the container. The description reads: My favorite coffee shop is opening a new website, but they locked it behind a combination lock page. Can you hack the page to get access early? Access the site here. Container is starting up. This usually takes 30 to 60 seconds, but may sometimes take up to 5 minutes. Status is checked every 5 seconds automatically. Cancel. Question 1, 100 points. Enter flag. Submit. Time remaining 59m 50s. Extend timeout. Delete. Service Cracking the Javashop. Protocol HTTP. Endpoint https://14b080725d613642.live.skillbit.io. Question 1, 100 points. Attempts 0/50 max. Enter flag. Submit. Last correct. MetaCTF{3arly_m0rning_c0ff33_4nd_h4cking}. 8/26/2025, 8:04:52 PM. Submission History (1). 1 attempt(s) / 50 max. Last correct. MetaCTF{3arly_m0rning_c0ff33_4nd_h4cking}. 8/26/2025, 8:04:52 PM. Solved. 100/100 points. Solved. Okay, so we're on the website. Here's the web app. It is a combination lock. If we click it, it will... Access Denied. Now let's take a look under the hood. I have developer tools open. We're gonna click some numbers. We're gonna click some numbers and we're gonna... Access Denied. And over here, I got a post request to check combination. And okay, 403, meaning access denied. So let's see. Ooh, request. This is client side validation here. It looks like we're saying the first digit is locked, the second digit is locked, the third digit is locked, and the fourth digit is open. That means to correctly, that the fourth digit being 2 is correct. We're validating this on the client side. The thing we can do is we can click through and keep trying until we just brute force our way to victory. However, nothing else that we can do is just manually send this request with all four digits specified to open. In the developer tools, each request is... So we are going to post to this URL, which is an API called combination. We're going to use a dash X POST. The endpoint. I'm gonna paste the endpoint. Gonna use a dash D for data. Back in the browser, click raw on the status or on the payload. We're gonna copy this line back. We're gonna paste it. We are just gonna change every locked to open. And we're gonna see what happens. An unsupported media type. Which means I need to modify. Alright, so we send that command. And we got an error. Did load JSON data because the request Content-Type was not application/json. So that means to add a header of Content-Type application/json. As a mime type. And it tells the server what type of data it's expecting to receive from the client. Now one more time. The browser request that the server could not understand. And I think I just need to add single quotes around. And here we go. A flag. Back on skillbit. And to the flag. We are done. Interesting point that I would note on this one is we didn't actually need to know the combination to bypass it. We just used the client side validation against itself. And we sent we never even knew what the server, hey, knows the code, and each one is open. Send it. Client side validation is no validation.