https://app.hackthebox.com/challenges/623

Description

On a moonless night, you delve into the dark web to uncover the hacker group “The Cryptic Shadows.” You find an encrypted message guiding you to a web challenge. They claim a cursed amulet, the ‘Amulet of Samhain,’ can unveil their treasures location

Exploitation

Just <img src="img.jpg" onerror=alert()> in Our Newsletter

Summary

SpookTastic: use the client-side injection path to steal the needed proof and recover the flag.