HackTheBox - Bookworm

Name: HackTheBox - Bookworm
Uploaded: 2024-01-20T15:26:49Z
Channel: IppSec
Description: 00:00 - Introduction 00:50 - Start of nmap 04:30 - Discovering a potential XSS in the Notes field of an order. Content Security Policy (CSP) blocks us, ...

IppSec · Beginner ·🔐 Cybersecurity ·2y ago

00:00 - Introduction 00:50 - Start of nmap 04:30 - Discovering a potential XSS in the Notes field of an order. Content Security Policy (CSP) blocks us, because JS cannot be on the same page. Looking for a file upload functionality. 08:29 - Finding out we can upload anything we want to the avatar. This should allow us to bypass the CSP in the book edit field 11:55 - Confirmed XSS on the page, checking if there's an IDOR Vulnerability that allows us to add notes to other people's items by creating a second account 16:00 - Creating a Python Script that will automatically poison items in peoples b…

Watch on YouTube ↗ (saves to browser)

Chapters (18)

Introduction

0:50 Start of nmap

4:30 Discovering a potential XSS in the Notes field of an order. Content Security P

8:29 Finding out we can upload anything we want to the avatar. This should allow us

11:55 Confirmed XSS on the page, checking if there's an IDOR Vulnerability that allo

16:00 Creating a Python Script that will automatically poison items in peoples baske

28:00 Backet Poisoner script is completed

28:50 Creating a JavaScript payload, explaining why I'm doing await, fetch, and help

40:15 Having the XSS Payload fetch profile, look for orders, then perform a get on a

49:55 Creating a Python Flask Server that will save all of the orders the XSS Payloa

56:00 Examining orders, discovering there is a "Download Everything" URL. Didn't sho

1:12:00 Extracting database.js, which contains the database information. The password

1:15:52 EDIT: Examining the source code to show why downloading a single book was not

1:21:04 Enumerating the box as Frank discovering a second web application listening on

1:30:00 Looking at the source code to the book converter.

1:36:20 Exploiting a SSRF/File Disclosure vulnerability in the Book Converter, but it

1:42:18 Finding Arbitrary File Write vulnerability in the Book Converter by abusing Sy

1:51:50 Shell as Neil who can run the GenLabel binary with Sudo, examining it to disco

Playlist

Uploads from IppSec · IppSec · 0 of 60

← Previous Next →