UHC - Backend

00:00 - Introduction 00:53 - Start of nmap 02:50 - Examining the webpage, just finding json. Running gobuster to discover /docs and /api 04:20 - Examining the user and admin endpoint, showing /user/ has a 404 but we can go into it 05:10 - Talking about why API Discovery differs from normal web, instead of extensions we fuzz methods 07:15 - Using wfuzz to fuzz endpoints in /user/ with POST Requests to discover /login and /signup 09:50 - Fuzzing the signup endpoint, reading error messages to identify the fields it wants 11:40 - Showing that curl behaves differently. Lets troubleshoot this by sending our curl and burpsuite to wireshark and seeing why its behaving differently 14:24 - Attempting to login to the API with the credential we created, discovering we need a urlencoded request 16:30 - Logging in and getting a JWT Token, accessing /docs/ with it which is swagger documentation 19:10 - Authenticating in the swagger, so we can use the web interface to access private functions 19:58 - Changing administrators password with the UpdatePass endpoint, which is an IDOR like vulnerability 20:30 - Logging in with admin, then accessing the admin functionality 22:30 - Exploring the /proc/self directory with the LFI and finding where the source code to this app lives 25:00 - Extracting the JWT Secret Key from app/core/config.py, and adding the debug parameter, which enables us to access the /access endpoint 26:20 - Showing we cannot use slashes or pluses on this endpoint 28:40 - Getting a reverse shell 29:29 - Discovering the root password in an authentication log, because someone entered a password in a username field 32:20 - Just looking at the code briefly. Should have prepared more to do this. Will probably do a separate video showing FastAPI.