HackTheBox - Health

Name: HackTheBox - Health
Uploaded: 2023-01-07T15:00:23Z
Channel: IppSec
Description: 00:00 - Intro 01:00 - Start of nmap 02:50 - Taking a look at the website 03:30 - Testing the webhook to see the app will send us information about a web...

IppSec · Beginner ·🔐 Cybersecurity ·3y ago

00:00 - Intro 01:00 - Start of nmap 02:50 - Taking a look at the website 03:30 - Testing the webhook to see the app will send us information about a web page 04:20 - Trying to access port 3000, getting blocked by a filter trying to include 127.0.0.1 and 0x7f000001 06:20 - Playing with the webhook to see if it will send us the entire page 07:10 - Having our webserver redirect to localhost, to see if this bypasses the filter and getting the web page on port 3000 10:20 - The application on port 3000 is gogs 0.5.5 which is from 2014! 12:15 - Setting up a local instance of GOGS so we can build a pa…

Watch on YouTube ↗ (saves to browser)

Chapters (17)

Intro

1:00 Start of nmap

2:50 Taking a look at the website

3:30 Testing the webhook to see the app will send us information about a web page

4:20 Trying to access port 3000, getting blocked by a filter trying to include 127.

6:20 Playing with the webhook to see if it will send us the entire page

7:10 Having our webserver redirect to localhost, to see if this bypasses the filter

10:20 The application on port 3000 is gogs 0.5.5 which is from 2014!

12:15 Setting up a local instance of GOGS so we can build a payload to exploit this

15:40 Playing with a union injection, then looking at the database to see number of

19:30 Have a basic Union Injection payload, grabbing multiple fields from the SQLite

23:30 Checking how the password is encoded by examining gogs source

26:10 Testing out cracking our hash

30:05 Passing our SQL Injection payload through SSRF to attack the target and get a

40:00 Using Pspy to see a cron job running as root that uses artisan to execute a we

44:00 Exploring the web source to discover the webserver uses file_get_contents on m

46:30 Poisoning the MySQL Database to have the monitored URL retrieve and send a fil

Playlist

Uploads from IppSec · IppSec · 0 of 60

← Previous Next →