HackTheBox - Intentions

00:00 - Introduction 01:00 - Start of nmap 02:30 - Looking at the login request, guessing it is Laravel based upon XSRF being in cookie and header 08:10 - Playing with updating genre and viewing feed to discover an error 10:04 - Opening up SQL Fiddle to explain what I think is going on, its using FIND_IN_SET 14:20 - Discovering space is a bad character and when this happens using the -- comment is bad 17:48 - Manually dumping the database with union statements 25:18 - Using SQL Map showing this SQL Injection 30:54 - Going over our recon and discovering a v2 admin login endpoint which lets us login with the password hash 38:28 - Logged in as an admin (Steve) 42:10 - Talking about Exploiting PHP Object Instanatiations then exploiting ImageMagick 1:01:20 - Shell returned, downloading .git, looking at commits and finding Greg's password 1:07:05 - Talking about the Scanner Binary and showing how we can leak the file one byte at a time 1:10:07 - Creating a python program to run the scanner binary thousands of times to leak files one byte at a time