NodeBlog Linux Easy machine #23

A vulnerable web application. Multiple attack surfaces. One Linux machine to compromise.
This Saturday as we take on NodeBlog, an Easy Linux machine from Hack The Box created by ippsec.
NodeBlog puts web application security in the spotlight, giving participants an opportunity to explore vulnerabilities commonly found in Node.js applications and understand how they can be chained to gain access to a system.

What we'll explore:
Web application enumeration
NoSQL injection and authentication bypass
XML External Entity (XXE) attacks
Insecure deserialization in Node.js
Remote code execution
Linux privilege escalation

What you'll gain:
You'll develop a better understanding of how to identify web application weaknesses, investigate application behaviour, exploit insecure implementations, and turn individual vulnerabilities into a complete attack path.

Whether you're new to penetration testing or looking to sharpen your practical skills, you're welcome to join us. No one needs to know everything beforehand — come ready to learn, experiment, ask questions and collaborate.