HackTheBox - CyberMonday

Name: HackTheBox - CyberMonday
Uploaded: 2023-12-02T14:59:25Z
Channel: IppSec
Description: 00:00 - Introduction 00:55 - Start of nmap, playing with the webapp discovering it is Laravel PHP App 06:50 - Discovering /assets is a redirect to /asse...

IppSec · Beginner ·📊 Data Analytics & Business Intelligence ·2y ago

00:00 - Introduction 00:55 - Start of nmap, playing with the webapp discovering it is Laravel PHP App 06:50 - Discovering /assets is a redirect to /assets/, indicator of the Nginx off by slash [MasterRecon] 11:50 - Using the Nginx off by slash to download .env and .git to get the source code to the app 14:00 - Start of code analysis 15:55 - Finding a Mass Assignment vulnerability in the update functionality 21:50 - Taking some time to explore if there are ways to find Mass Assignment without looking at the code or guessing 27:30 - Looking at the Webhooks-api-beta website, playing with the requ…

Watch on YouTube ↗ (saves to browser)

Chapters (19)

Introduction

0:55 Start of nmap, playing with the webapp discovering it is Laravel PHP App

6:50 Discovering /assets is a redirect to /assets/, indicator of the Nginx off by s

11:50 Using the Nginx off by slash to download .env and .git to get the source code

14:00 Start of code analysis

15:55 Finding a Mass Assignment vulnerability in the update functionality

21:50 Taking some time to explore if there are ways to find Mass Assignment without

27:30 Looking at the Webhooks-api-beta website, playing with the request and discove

30:40 Playing with the JWT, Discovering its a RS256 encoded, doing an Algorithm Conf

41:50 Playing with the Webhook and discovering a SSRF, which we can also do protocol

46:30 Looking at the Redis Migrate functionality which confirms we can interact with

52:28 Inserting a poisoned laravel cookie into redis we created with phpggc, trouble

1:17:50 Reverse shell returned, examining the mysql database and redis keys

1:30:10 Uploading a static nmap to scan the docker containers finding a docker registr

1:49:35 Source code analysis on the webhook code, discovering a file disclosure and ha

2:02:50 Dumping the environment variables, getting the DB Password which is also a use

2:08:30 John can run docker compose on a sanitized docker file, there are a few ways t

2:12:10 Showing we can pass in a raw device, which works without adding any special ca

2:30:30 Showing we can also pass in a volume as RO and give

Playlist

Uploads from IppSec · IppSec · 0 of 60

← Previous Next →