http://www.adhikariashwin0.com.np/tags/xlst-injection/ Recent content in XLST Injection on the008Killer Hugo en Sat, 21 Mar 2026 00:00:00 +0000 http://www.adhikariashwin0.com.np/writeups/hackthebox/conversor/ Sat, 21 Mar 2026 00:00:00 +0000 http://www.adhikariashwin0.com.np/writeups/hackthebox/conversor/ <h2 id="overview">Overview</h2> <table> <thead> <tr> <th>Category</th> <th>Info</th> </tr> </thead> <tbody> <tr> <td>Machine Name</td> <td>Conversor</td> </tr> <tr> <td>Difficulty</td> <td>Easy</td> </tr> <tr> <td>Release Date</td> <td>25 oct 2025</td> </tr> <tr> <td>Author</td> <td>fismathack</td> </tr> <tr> <td>OS</td> <td>Linux</td> </tr> <tr> <td>Pwned Date</td> <td>12 Nov 2025</td> </tr> </tbody> </table> <hr> <h2 id="reconnaissance">Reconnaissance</h2> <h3 id="nmap-scan">Nmap Scan</h3> <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl">nmap -sC -sV -oN nmap_initial.txt &lt;target-ip&gt; </span></span></code></pre></div><p><strong>Findings:</strong></p> <ul> <li><strong>Port 22</strong> — ssh</li> <li><strong>Port 80</strong> — http</li> </ul> <hr> <h2 id="web-analysis">Web Analysis</h2> <p>We are given a login page which gives <strong>&ldquo;Invalid credentials&rdquo;</strong> response for invalid credentials. After registering a user we get into a page which converts XML files to asthetic formats using XSLT stylesheet. <img alt="Home" loading="lazy" src="http://www.adhikariashwin0.com.np/writeups/hackthebox/conversor/screenshots/homepage.png"></p>