Three HTB-style web challenges, each a small ransomware-as-a-service panel guarded by a headless admin bot. Three roads to the flag: a DOM sink, a forged token, and a poisoned cache.

A home-grown URL parser drops ?search= straight into innerHTML. A crafted report ID makes the admin bot open it and leaks its flag cookie.

A three-bug chain: unkeyed cache inputs let you plant settings under the bot's key, a naive recursive merge pollutes Object.prototype, and a jQuery 3.6.0 gadget turns that into XSS on the bot.

The JWT verification secret is looked up from the DB using the token's own kid header — concatenated into raw SQL. A UNION SELECT lets you supply the verifying key and forge an admin token.