FeedDiscussion
TryHackMe : Do Not Disturb Writeup
TL;DR Byte Lotus Poolside is a Node.js/Express booking app. A NoSQL injection in the login endpoint bypasses authentication entirely and lands directly in the staff role. The staff console's booking-c
exploitnotes.hashnode.dev8 min read
#do-not-disturb#do-not-disturb-thm#tryhackme#thm#thm-writeup#nosql-injection#mongodb-injection#authentication-bypass#ejs#server-side-template-injection#ssti#nodejs#expressjs#remote-code-execution#rce#node-inspector#chrome-devtools-protocol
Responses
No responses yet.