2 soat boshimni qotirgan joy )
/flag endpointida:
const remoteAddress = req.connection.remoteAddress;
Avval X-Forwarded-For orqali 127.0.0.1 qilib bypass qilaman deb o‘yladim. Lekin remoteAddress headerdan emas, TCP socket'dan olinar ekan.
Keyin boshqa yo‘lga o‘tdim. /update endpointida:
Note.findByIdAndUpdate(noteId, req.body)
user input'ini to‘g‘ridan-to‘g‘ri MongoDB update'ga berayotganini ko‘rdim.
$set ishlashini tekshirdim → keyin $rename orqali:
title → __proto__._peername.address
qilib, 127.0.0.1 qiymatini prototype'ga olib kirdim.
Keyin /flag:
200 OK
HTB{xxxxxxxxxxx}
Bu challenge'dan asosiy lesson:
Qiymat qayerdan kelayotganini tushunmasdan turib, uni qanday bypass qilishga yopishib qolmaslik kerak :)

Nu qarelar shundan kegin tushundim men bundan 2 yil oldin qigan hamma Full Stack loyihalarimi aynan shu logika bilan qigan ekanman, hammasida Prototype Polution bor ekan palakat )

Backend Node.Js / Express.js da yozilgan edi

Turan Security kompaniyasi Cyber Security Summit | CENTRAL EURASIA – CSS 2026 ishtirokchilari safida!
Turan Security — yetakchi kiberxavfsizlik kompaniyasi va Markaziy Osiyodagi birinchi CVE Numbering Authority (CNA) hisoblanadi. Kompaniya tadqiqotchilari NASA, Google, Nvidia, Amazon, Alibaba kabi global texnologiya kompaniyalarining Hall of Fame dasturlarida ham e'tirof etilgan.
120 dan ortiq mijozga ega kompaniya SOC as a Service, penetratsion testlar, ISO/IEC 27001 va PCI DSS bo'yicha konsalting hamda auditlar, DevSecOps va boshqa kiberxavfsizlik xizmatlarini taqdim etadi. Ushbu xizmatlar tashkilotlarga kiberxatarlarni boshqarish, xavfsizlik nazorati vositalarini mustahkamlash va muhim raqamli infratuzilmani himoya qilishda yordam beradi.
CSS 2026 doirasida Turan Security o'zining Bug bounty va Threat intelligence platformalarini namoyish etadi — ular zaifliklarni aniqlash, yangi tahdidlarni kuzatib borish va tashkilotlarning umumiy xavfsizlik darajasini oshirish uchun amaliy yechimlarni taklif qiladi.
Turan Security jamoasi bilan 6–7 oktabr kunlari Toshkentda bo'lib o'tadigan CSS 2026 da uchrashing!


We are pleased to welcome Turan Security to Cyber Security Summit | CENTRAL EURASIA – CSS 2026!

Turan Security is a leading cybersecurity company and the first CVE Numbering Authority (CNA) in Central Asia. Its cybersecurity researchers have also been recognised in the Hall of Fame programmes of global technology companies like NASA, Google, Nvidia, Amazon, Alibaba.

With a portfolio of 120+ clients, company provides SOC as a Service, penetration testing, ISO/IEC 27001 and PCI DSS consulting and audits, DevSecOps, and other cybersecurity services designed to help organisations manage cyber risks, strengthen security controls and protect critical digital infrastructure.

At CSS 2026, Turan Security will showcase its bug bounty and threat intelligence platforms, offering practical solutions for identifying vulnerabilities, monitoring emerging threats and strengthening organisations’ overall security posture.

Meet the Turan Security team at CSS 2026 in Tashkent on 6-7 October.

Hello world

Tommorow be like ))

Qopolroq hazl 🤣

Ozi cyberkent ga siqilib otirudim eshigimi tagiga endi armiyaga chaqirib kelishdi WTF 🗿

Qizu boldi )

Kelishimiz

Mmddaaaa agentlar bir biridan ozyapti, GPT-7. ni kutamiz )