Challenge ·Medium

Hack The NFT Museum

Lenin Alevski
by  Lenin Alevski · on
KubernetesSecurity
Test your Kubernetes hacking skills! Can you break into the NFT Museum and get the golden ape? Prove you're good enough in this challenge.
#kubernetes-101

Quick Start

  1. Once the playground is started, click on the Webapp tab to access the NFT Museum. This will open the NFT Museum in an external browser so you can use all your favorite tools.
Open external browser
Hack The NFT Museum
  1. The kali tab offers a fully functional Kali Linux environment.
Kali Linux
  1. Happy hacking 🏴‍☠️💻.

Challenge

Welcome to the NFT Museum challenge! In this challenge, you'll explore common security vulnerabilities in cloud-native environments by attempting to compromise a modern NFT marketplace running on Kubernetes.

Your mission is to investigate the platform and find potential security flaws that could lead to a compromise of the application.

Hint 1

Did you looked at the /robots.txt file 😉?

References

How to Author Challenges on iximiuz Labs

Instead of providing a subpar online editing experience, iximiuz Labs offers a helper CLI tool called labctl, allowing you to use your favorite text editor (or a full-featured IDE) to write content from the comfort of your local machine.

Install labctl CLI

curl -sf https://labs.iximiuz.com/cli/install.sh | sh

This will download and install the latest version of the labctl CLI. You only need to do this once per workstation.

Authorize labctl

labctl auth login

This will open a browser window asking you to authorize labctl to access your account. You need to do it after a fresh install of labctl and repeat it whenever the auth session expires.

Pull challenge content

labctl content pull challenge kubernetes-security-hack-the-nft-museum-53fefad7

This will create a local copy of the challenge content in a directory named kubernetes-security-hack-the-nft-museum-53fefad7. You only need to do this once per challenge.

Stream your changes

labctl content push -fw challenge kubernetes-security-hack-the-nft-museum-53fefad7

Run this command in a separate terminal to continuously upload your changes to the server while editing the challenge in your favorite text editor or IDE.

You can also use labctl to create, list, and delete your content. Learn more about the available commands: labctl content --help

Start challenge