[LOOOP]

https://app.hackthebox.com/challenges/htbank

This forum account is currently banned. Ban Length: Permanent (N/A Remaining)
Ban Reason: Compromised - Malware Logs

[cavour13]

i tried ssti but nothing seems to work with user input!

Any ideas?

[LOOOP]

No i am also STUCK.

This forum account is currently banned. Ban Length: Permanent (N/A Remaining)
Ban Reason: Compromised - Malware Logs

[ZombieBear]

Look at home.js

xhr.open('GET', "https://api.etherscan.io/api?module=account&action=balance&address=0x5A0b54D5dc17e0AadC383d2db43B0a0D3E029c4c&tag=latest&apikey=FH12Z2IYGM3JKD1RN42NG6VHSXV73YX61H", true);

[LOOOP]

Look at home.js

xhr.open('GET', "https://api.etherscan.io/api?module=account&action=balance&address=0x5A0b54D5dc17e0AadC383d2db43B0a0D3E029c4c&tag=latest&apikey=FH12Z2IYGM3JKD1RN42NG6VHSXV73YX61H", true);

This looks like web3

This forum account is currently banned. Ban Length: Permanent (N/A Remaining)
Ban Reason: Compromised - Malware Logs

[ZombieBear]

No, if you are looking at:

$('.bal').text(bal.toFixed(4));

[Dr1s]

I tired ssti , nothin , also that api seems that have no permission to modify balance only allows to see the balance of the account, any ideas?

[Dr1s]

it's super simple skid parameter pollution

Can u give me more details plz

[g405t]

wow nice challenge

[Dr1s]

poison the withdraw request, find the right amount

More details plz?