HackTheBox - Ouija

Name: HackTheBox - Ouija
Uploaded: 2024-05-18T15:05:16Z
Channel: IppSec
Description: 00:00 - Introduction 01:00 - Start of nmap 03:15 - Fuzzing the API port port 3000 with ffuf 09:00 - Discovering the Gitea Domain and seeing a repo which...

IppSec · Beginner ·🔐 Cybersecurity ·1y ago

00:00 - Introduction 01:00 - Start of nmap 03:15 - Fuzzing the API port port 3000 with ffuf 09:00 - Discovering the Gitea Domain and seeing a repo which discloses HA Proxy 2.2.16 is in use 11:50 - Exploring CVE-2021-40346 an integer overflow in HA Proxy which enables HTTP Smuggling 18:00 - Putting a 3rd request in to make the HTTP Smuggle reliable and grabbing the source code to app.js 28:45 - Taking a look at the APP.JS source code and discovering a Hash Length Extension attack 38:14 - Performing the Hash Lenght Extension attack and then using FFUF to find the length of the secret 45:00 - Hav…

Watch on YouTube ↗ (saves to browser)

Chapters (18)

Introduction

1:00 Start of nmap

3:15 Fuzzing the API port port 3000 with ffuf

9:00 Discovering the Gitea Domain and seeing a repo which discloses HA Proxy 2.2.16

11:50 Exploring CVE-2021-40346 an integer overflow in HA Proxy which enables HTTP Sm

18:00 Putting a 3rd request in to make the HTTP Smuggle reliable and grabbing the so

28:45 Taking a look at the APP.JS source code and discovering a Hash Length Extensio

38:14 Performing the Hash Lenght Extension attack and then using FFUF to find the le

45:00 Have another File Disclosure, chaining it with the /proc symlink to read an SS

52:45 Discovering port 9999

58:00 Opening the PHP Library up in Ghidra and discovering an integer overflow

1:04:00 Creating a C Program to explain the integer overflow

1:11:50 Setting up a test environment so we can debug the PHP Library and see how it b

1:17:15 Getting a breakpoint to work and stepping through things in lverifier.so

1:21:00 Creating a pattern so we can see where we write data to

1:24:22 Creating a python script to build our payload

1:35:50 Running into an issue, discovering the first parameter doesn't terminate where

1:46:45 Burpsuite wasn't URL Encoded a linebreak, doing it ourselves and then getting

Playlist

Uploads from IppSec · IppSec · 0 of 60

← Previous Next →