HackTheBox - Forgot

Name: HackTheBox - Forgot
Uploaded: 2023-03-04T15:00:40Z
Channel: IppSec
Description: 00:00 - Introduction 01:03 - Start of nmap 02:00 - Talking about Varnish, then looking at the website 03:40 - Poking at the Forgot Password functionalit...

IppSec · Beginner ·🔐 Cybersecurity ·3y ago

00:00 - Introduction 01:03 - Start of nmap 02:00 - Talking about Varnish, then looking at the website 03:40 - Poking at the Forgot Password functionality and showing we can enumerate valid users 06:25 - Discovering a username in the HTML Source 07:10 - Start talking about Host Header Injection, showing the page will use the Host Header when building redirects 09:28 - Using host header injection in the password reset, in order to send the user a link that goes to our box 11:00 - Explaining host header injection password reset in depth 13:00 - Live Demo showing that Host Header Injection on Pass…

Watch on YouTube ↗ (saves to browser)

Chapters (18)

Introduction

1:03 Start of nmap

2:00 Talking about Varnish, then looking at the website

3:40 Poking at the Forgot Password functionality and showing we can enumerate valid

6:25 Discovering a username in the HTML Source

7:10 Start talking about Host Header Injection, showing the page will use the Host

9:28 Using host header injection in the password reset, in order to send the user a

11:00 Explaining host header injection password reset in depth

13:00 Live Demo showing that Host Header Injection on Password Reset may not require

14:10 Sending an email to myself, then checked Burpsuite Collaborator and saw some b

16:43 Showing what Robert can do in the web application and discovering some odd beh

21:10 Identifying when Varnish decides to cache things by looking at the age header,

24:30 Getting the administrator to click a link on /admin_tickets/static/Junk, which

26:55 Going in-depth with the Web Cache Deception attack and how Varnish works

27:50 Showing the Varnish configuration

29:00 Editing the Varnish configuration to add UserAgent as part of the caching logi

33:00 Explaining the weird behavior with how the flask app does routing and allows t

34:45 Checking what Diego can run via sudo and discovering he can execute ml_securit

Playlist

Uploads from IppSec · IppSec · 0 of 60

← Previous Next →