Hack The Box — How to Get Invite Code

Update: HTB has been removed the invite challenge


What is Hack The Box (HTB) ?

An online platform to test and advance your skills in penetration testing and cyber security

Yes, it is a virtual penetration testing lab. It allows you to test your penetration testing skills like enumeration, exploitation, pwn, cryptos and stegano, OSINT, and many others.

Cool, right?

In order to join HackTheBox, you need to get your own invitation code by completing the invite challenge in https://www.hackthebox.eu/invite.

Hack the Box Invitation Page

So let’s jump in!

Check the console!

But, I’ll do it in a little different approach.

First, let’s check the page source first (CTRL + U), you can access from the console, it is on the Elements tab. There is an interesting file called inviteapi.min.js

Page source code

The code inside inviteapi.min.js seems has been obfuscated

Obfuscated javascript

We can use beautifier to deobfuscate the code, but before that, we can try to type the readable code in our console. Looks like the makeInviteCode() can be called!

By calling it from the console, we get the following result.


With beautifier, the source code looks like this.

The data from the response is encoded with base64, we can use online base64 decoder to decode it.

Alternatively, you can use terminal (if you’re on linux or has msys installed)

$ echo '[encoded base64 data]' | base64 -d

The decoded data tells us to make a POST request to URI of /api/invite/generate.

In order to do this, we can use curl.

curl is pre-installed on Linux and Windows (starting from build 17063 or higher). If you don’t have it, go to this link https://curl.se/download.html

To send a POST request, we can use -X option to define the request type which is a POST.

curl -X POST https://www.hackthebox.eu/api/invite/generate

And we get the following result,

The code inside the data looks encoded with base64 too.

We’re almost there! So let’s go back and decode it with base64 decoder.

Great, you got the invitation code!

Now, go back to the invitation page and paste that code there.

Note that new tab will generate a new invitation code, so don’t use a new tab to insert your invitation code.

Thank you!

Curious to learn how things work, especially in digital world || Site: https://fahmifj.github.io/