Update: HTB has been removed the invite challenge
In this article, I’ll do a walkthrough on how to get Hack The Box invitation code.
What is Hack The Box (HTB) ?
Well, according to the web description, HTB is :
An online platform to test and advance your skills in penetration testing and cyber security
Yes, it is a virtual penetration testing lab. It allows you to test your penetration testing skills like enumeration, exploitation, pwn, cryptos and stegano, OSINT, and many others.
In order to join HackTheBox, you need to get your own invitation code by completing the invite challenge in https://www.hackthebox.eu/invite.
So let’s jump in!
Check the console!
Recently, Hack The Box putting a hint in the invitation page, so you can just check your console using CTRL+SHIFT+I or F12.
But, I’ll do it in a little different approach.
First, let’s check the page source first (CTRL + U), you can access from the console, it is on the Elements tab. There is an interesting file called
The code inside inviteapi.min.js seems has been obfuscated
We can use beautifier to deobfuscate the code, but before that, we can try to type the readable code in our console. Looks like the
makeInviteCode() can be called!
By calling it from the console, we get the following result.
With beautifier, the source code looks like this.
The data from the response is encoded with base64, we can use online base64 decoder to decode it.
Alternatively, you can use terminal (if you’re on linux or has msys installed)
$ echo '[encoded base64 data]' | base64 -d
The decoded data tells us to make a POST request to URI of
In order to do this, we can use curl.
curl is pre-installed on Linux and Windows (starting from build 17063 or higher). If you don’t have it, go to this link https://curl.se/download.html
To send a POST request, we can use -X option to define the request type which is a POST.
curl -X POST https://www.hackthebox.eu/api/invite/generate
And we get the following result,
The code inside the data looks encoded with base64 too.
We’re almost there! So let’s go back and decode it with base64 decoder.
Great, you got the invitation code!
Now, go back to the invitation page and paste that code there.
Note that new tab will generate a new invitation code, so don’t use a new tab to insert your invitation code.