VulnHub - DC-9

Name: VulnHub - DC-9
Uploaded: 2020-03-29T20:28:57Z
Channel: IppSec
Description: 00:34 - Explaining how networking is setup, then nmap 04:00 - Examining why nmap says a port is filtered in Wireshark 07:30 - Exploring the webpage and ...

IppSec · Beginner ·🔐 Cybersecurity ·6y ago

00:34 - Explaining how networking is setup, then nmap 04:00 - Examining why nmap says a port is filtered in Wireshark 07:30 - Exploring the webpage and doing basic SQL Injections in the search functionality 08:10 - Starting GoBuster in the background, #AlwaysHaveReconRunning 10:10 - Explaining SQL Injection 13:55 - Explaining SQL Union Injection 15:15 - Testing Union Injection by doing “UNION SELECT”, then testing it by doing “ORDER BY”. 19:00 - Explaining how to get data out of INFORMATION_SCHEMA 20:55 - Doing GROUP_CONCAT to extract multiple lines from a UNION Statement 27:00 - Using SED to…

Watch on YouTube ↗ (saves to browser)

Chapters (23)

0:34 Explaining how networking is setup, then nmap

4:00 Examining why nmap says a port is filtered in Wireshark

7:30 Exploring the webpage and doing basic SQL Injections in the search functionali

8:10 Starting GoBuster in the background, #AlwaysHaveReconRunning

10:10 Explaining SQL Injection

13:55 Explaining SQL Union Injection

15:15 Testing Union Injection by doing “UNION SELECT”, then testing it by doing “ORD

19:00 Explaining how to get data out of INFORMATION_SCHEMA

20:55 Doing GROUP_CONCAT to extract multiple lines from a UNION Statement

27:00 Using SED to replace “,” with line breaks and extracting a bunch of informatio

33:00 Cracking the hash to see admin’s password is transorbital1

34:41 Using wfuzz to brute force a login prompt with two FUZZ Variables (some troubl

43:30 Fuzzing the MANAGE.PHP script for a filename parameter with wfuzz

48:50 Exploring the LFI

1:00:00 Using LFI with /proc/sched_debug to get processes running and discovering Knoc

1:04:30 The Opening up the SSH Port with port knocking

1:10:00 Using medusa combo list to test SSH Credentials, then logging chandlerb and ru

1:16:00 Exploring the MySQL Database, discovering Janitor was created at a different t

1:22:00 Using find to output a list of readable files for other users then finding fil

1:28:50 FredF can execute the “test” binary as root. Looking at source, it allows app

1:30:15 File Write Method 1: Appending a line to allow joeyt to sudo

1:33:30 File Write Method 2: Appending line to passwd to create a new user

1:36:50 Extra content, going over the Source Code to view the LFI Exploit and a pretty

Playlist

Uploads from IppSec · IppSec · 0 of 60

← Previous Next →