HackDonalds Challenge Writeup

By /

Table of Contents

Description:

The challenge was solved by chaining an authentication bypass with an XXE vulnerability. By adding the HTTP header X-Middleware-Subrequest: middleware, the application mistakenly granted access to restricted admin functionality without proper authentication. This allowed interaction with sensitive internal features that would normally require admin privileges. Using this access, an XML External Entity (XXE) payload was submitted to an XML-processing endpoint. The XXE payload was crafted to read the file package.json from the application’s current working directory via the symbolic path /proc/self/cwd/package.json. This file contained the challenge flag, confirming that both the authentication bypass and XXE were successfully exploited.

POC:

  1. I have bypass the login with this header X-Middleware-Subrequest: middleware directly access into admin

2. Click on Ice Cream Machines then click on view settings

3. i have used this payload in the XML Configuration Settings

4. Finally grab the flag

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "file:///proc/self/cwd/package.json">
]>
<stockCheck><productId>&xxe;</productId></stockCheck>

Flag :

INTIGRITI{XXE_Redacted_M4ch1n3s}

Reference :

  1. https://app.intigriti.com/researcher/programs/intigriti/challenge-hackdonalds/detail
  2. https://nagasaikiran.com/middleware-mishap-a-deep-dive-into-next-js-cve-2025-29927/

48 thoughts on “HackDonalds Challenge Writeup”

  20. abc8viplogin

    Alright listen up, abc8viplogin is my go-to spot. Easy to navigate and the games are actually pretty fun. Give it a shot, might become your new favorite too If you’re looking for something new to try, check it out here: abc8viplogin

    Reply
  21. jilipark22

    Yo, jilipark22 caught my attention recently. The selection of games is decent, and I found a few I really enjoy. I’d say give it a try and see for yourself If it vibes with you, that’s great Check out jilipark22 here: jilipark22

    Reply
  22. bl888bet

    Yo, heard about bl888bet from a buddy. Figured I’d give it a shot. It’s got a decent selection and the odds seem competitive. Not bad at all! Head over to bl888bet and see for yourself.

    Reply
  23. tt88bet

    tt88bet has been on my radar for a while. Finally checked it out and I’m impressed. The bonuses are pretty sweet. All players like getting bonuses as much as I do with tt88bet

    Reply

Leave a Comment

Your email address will not be published. Required fields are marked *

Scroll to Top