Breadcrumbs

Verified writeups for the Breadcrumbs machine of Hack The Box

Breadcrumbs

$ tldr LFI + JWT forge → webshell → sticky notes binary + AES decrypt

·	·
Operating system	Windows
Difficulty	Hard
Vector	Crypto
IP	10.10.10.228
Retirement date	2021-07-17
Skills	Local File Inclusion (LFI) [Abusing file_get_contents] Abusing No Redirect Forge PHPSESSID and getting valid Cookies Forge JWT Uploading WebShell Obtaining system credentials through the webshell Abusing Sticky Notes Binary Analysis (Radare2) SQL Injection (SQLI) [Error Based] AES Decrypt (Cyberchief)

Writeups

Language	Author	Format	Link
🇪🇸 ES	S4vitar	Vídeo	Open
🇬🇧 EN	0xdf	Texto	Open
🇬🇧 EN	IppSec	Vídeo	Open

Skill resources

Curated documentation for each technique listed in the Skills column above. Sources: HackTricks, GTFOBins, PortSwigger, etc.

Skill	Source	Link
Local File Inclusion (LFI)	HackTricks	Open
Local File Inclusion (LFI)	PayloadsAllTheThings	Open
SQL Injection	HackTricks	Open
SQL Injection	PortSwigger	Open
JSON Web Tokens (JWT)	PortSwigger	Open

Related skills worth mastering

Remote Code Execution (RCE) · Remote File Inclusion (RFI) · Cross-Site Scripting (XSS)

If you liked this machine, try

• Unicode — Linux, Medium
• Giddy — Windows, Medium
• EarlyAccess — Linux, Hard
• Secret — Linux, Easy
• Tabby — Linux, Easy

---

Comments & tips

Did the official writeup not work? Found a smarter trick? Share it here — comments live in GitHub Discussions.

Last updated: 2026-06-07