UHC - Backend

Name: UHC - Backend
Uploaded: 2022-04-12T13:36:21Z
Channel: IppSec
Description: 00:00 - Introduction 00:53 - Start of nmap 02:50 - Examining the webpage, just finding json. Running gobuster to discover /docs and /api 04:20 - Examini...

IppSec · Beginner ·🔐 Cybersecurity ·3y ago

00:00 - Introduction 00:53 - Start of nmap 02:50 - Examining the webpage, just finding json. Running gobuster to discover /docs and /api 04:20 - Examining the user and admin endpoint, showing /user/ has a 404 but we can go into it 05:10 - Talking about why API Discovery differs from normal web, instead of extensions we fuzz methods 07:15 - Using wfuzz to fuzz endpoints in /user/ with POST Requests to discover /login and /signup 09:50 - Fuzzing the signup endpoint, reading error messages to identify the fields it wants 11:40 - Showing that curl behaves differently. Lets troubleshoot this by sen…

Watch on YouTube ↗ (saves to browser)

Chapters (19)

Introduction

0:53 Start of nmap

2:50 Examining the webpage, just finding json. Running gobuster to discover /docs a

4:20 Examining the user and admin endpoint, showing /user/ has a 404 but we can go

5:10 Talking about why API Discovery differs from normal web, instead of extensions

7:15 Using wfuzz to fuzz endpoints in /user/ with POST Requests to discover /login

9:50 Fuzzing the signup endpoint, reading error messages to identify the fields it

11:40 Showing that curl behaves differently. Lets troubleshoot this by sending our c

14:24 Attempting to login to the API with the credential we created, discovering we

16:30 Logging in and getting a JWT Token, accessing /docs/ with it which is swagger

19:10 Authenticating in the swagger, so we can use the web interface to access priva

19:58 Changing administrators password with the UpdatePass endpoint, which is an IDO

20:30 Logging in with admin, then accessing the admin functionality

22:30 Exploring the /proc/self directory with the LFI and finding where the source c

25:00 Extracting the JWT Secret Key from app/core/config.py, and adding the debug pa

26:20 Showing we cannot use slashes or pluses on this endpoint

28:40 Getting a reverse shell

29:29 Discovering the root password in an authentication log, because someone entere

32:20 Just looking at the code briefly. Should have prepared more to do this. Will

Playlist

Uploads from IppSec · IppSec · 0 of 60

← Previous Next →