NodeBlog

Verified writeups for the NodeBlog machine of Hack The Box

NodeBlog

$ tldr NoSQL auth bypass + XXE → NodeJS deser IIFE

·	·
Operating system	Linux
Difficulty	Easy
Vector	Web
IP	10.10.11.139
Retirement date	2022-01-10
Skills	NoSQL Injection (Authentication Bypass) XXE File Read NodeJS Deserialization Attack (IIFE Abusing) Mongo Database Enumeration

Writeups

Language	Author	Format	Link
🇪🇸 ES	S4vitar	Vídeo	Open
🇬🇧 EN	0xdf	Texto	Open
🇬🇧 EN	IppSec	Vídeo	Open

Skill resources

Curated documentation for each technique listed in the Skills column above. Sources: HackTricks, GTFOBins, PortSwigger, etc.

Skill	Source	Link
Authentication Vulnerabilities	PortSwigger	Open
Insecure Deserialization	PortSwigger	Open
SQL Injection	HackTricks	Open
SQL Injection	PortSwigger	Open
XML External Entity	HackTricks	Open

Related skills worth mastering

Remote Code Execution (RCE) · Cross-Site Scripting (XSS) · Local File Inclusion (LFI) · Server-Side Request Forgery

If you liked this machine, try

• Cache — Linux, Medium
• BountyHunter — Linux, Easy
• Aragog — Linux, Medium
• Celestial — Linux, Medium
• DevOops — Linux, Medium

---

Comments & tips

Did the official writeup not work? Found a smarter trick? Share it here — comments live in GitHub Discussions.

Last updated: 2026-06-07