HTB MakeSense Complete Writeup - Client-Side Crypto, Stored XSS & Root PHP Dev Server

A comprehensive penetration testing guide exploiting a hardcoded client-side encryption key in a WordPress custom theme, forging encrypted payloads for stored XSS to achieve admin access, escalating to PHP code execution via malicious plugin upload, and ultimately abusing a root-owned OCR web application to reach root.

July 22, 2026 • views • 16 min read • 1,874 words

By

Havoc

hackthebox 30 htb 34 wordpress client-side-encryption hardcoded-key crypto-failure stored-xss cross-site-scripting admin-bot admin-ajax plugin-upload php-execution wp-config ssh 4 lateral-movement 9 privilege-escalation 21 ocr php-dev-server localhost port-forwarding webshell season11 8 medium-difficulty 9 linux 14 webagency-theme voice-contact submit-contact-form save-voice-results forged-payload