HackTheBox - Previse

Name: HackTheBox - Previse
Uploaded: 2022-01-08T15:03:02Z
Channel: IppSec
Description: 00:00 - Intro 01:00 - Start of nmap 02:00 - Running GoBuster, discovering the redirects have filesizes 03:00 - Showing the Execute After Read vulnerabil...

IppSec · Beginner ·🔐 Cybersecurity ·4y ago

00:00 - Intro 01:00 - Start of nmap 02:00 - Running GoBuster, discovering the redirects have filesizes 03:00 - Showing the Execute After Read vulnerability (EAR) by using BurpSuite to hit / and discovering the page 04:00 - Using grep to show us only what we want (oP) 06:30 - Using BurpSuite to intercept the response to the request so we can disable the redirect (EAR). Then using the webform to create an account (IDOR) 08:00 - Examining the website source, using grep to look for places with user input 11:30 - Testing the logs.php page for shell injection, then getting a reverse shell 13:30 - Go…

Watch on YouTube ↗ (saves to browser)

Chapters (16)

Intro

1:00 Start of nmap

2:00 Running GoBuster, discovering the redirects have filesizes

3:00 Showing the Execute After Read vulnerability (EAR) by using BurpSuite to hit /

4:00 Using grep to show us only what we want (oP)

6:30 Using BurpSuite to intercept the response to the request so we can disable the

8:00 Examining the website source, using grep to look for places with user input

11:30 Testing the logs.php page for shell injection, then getting a reverse shell

13:30 Going into the webconfig to get database creds, then dump and crack creds

19:50 Testing local users with the passwords from the database to get m4lwhere's cre

20:25 Checking sudo to see something is weird, the env_reset/secure_path is not ther

22:10 Explaining Path Injection, then taking advantage of a script in sudo not using

25:30 Going back to explain things, weird behavior of the webserver always hanging.

28:00 Fuzzing parameters of accounts.php to create accounts. But first discovering h

30:50 Using WFUZZ to fuzz the confirmation parameter

35:20 Explaining how the EAR Vulnerability happened in the code and how to fix it

Playlist

Uploads from IppSec · IppSec · 0 of 60

← Previous Next →