Cloudflare CDN CSP - XSS Bypass / HackTheBox Cyber Apocalypse CTF

[@dedkeny]

Many things were learned today from Javascript & XSS to video-editing, thanks John!

[@anonymousmokona8541]

This video series got me to finally start learning pentesting - I always perceived it as something arcane and intimidating, but seeing how you struggle with node got me thinking that there is no shame in sucking at stuff.

[@kaihuang5420]

38:08 is starting of the dulpicate of previous content till 51:58. hope you can fix it! But great job!!!! John Thanks a lot for suffering for us non-javascript fanboys.

[@timothybadenach2411]

good to see that a security professional with 10 plus years can still struggle getting up the hill, so to speak. Gives guys that are learning motivation to keep going

[@CyberAbyss007]

Thank you! I'm actually starting to get this stuff! Appreciate that you show how hard this stuff is and how much patience is required.

[@sumedh1678]

Let’s give a moment of appreciation for the amazing walkthrough. Thanks John.

[@hamzabettache497]

I just like how you talk with your self and make actions :D it helps a lot : ) thanks for your videos, keep them ON.

[@dennismunyaka6537]

watching john work is like watching myself hack. I would've however given up, the live learning, googling and also building of payloads gives your channel an authentic human touch. as opposed to all other channels just regurgitating payloads from writeups. kudos

[@teddybear9152]

another video and another day of learning for me, thanks again John for all your hard work. Kudos to you for doing all this for us and still doing a day job and "life"!

[@jacobsilva421]

I love the videos where there is 5 minutes left and he's still pulling his hair out. Just knowing he's about to find the one little mistake borking it up.

[@xAngoryx]

Just found your channel and really loving your content

[@giusepperandazzo91]

I like your approach...it's is similar to a software engineer daily job...read, understand, try, fail repeat and so on...

[@businessgoose8605]

Like last year when I subed to you, you had like 80k followers. Keep going bro!

[@mukundbhuva]

Hey, seems like the video is duplicated from 38:08. Love from India ❤️.

[@theisoj]

I noticed the same thing. I think that John made a mistake accidentally.

[@blackjackdealer204]

I pace around my room when John releases content..

[@diddyman1958]

I understood very little of that but it was great to see you get the flag in the end.

[@peterchari3839]

This is amazing. We learn new things everyday!!!!!!! CSP, fetch

[@_DeProgrammer]

Using an editor like vim with bracket highlighting would prevent painful mistakes like this. Brutal! Good video tho.

[@jannikmeissner]

Yes, I had fun! Another great video that made my day

[@Grommish]

An Ide or setting Sublime for the context you're languaging on would help. Would make the inevitable formatting errors stand out

[@neilthomas1907]

ngl !! lowkey better than netflix rn

[@mossdem]

This has been me trying to wrap my head around 'self' the past few days in Python lol

[@kadensharpin2156]

my eyes struggled to watch John struggle through the JS

[@alandonaly457]

I always learn a lot from you , thanks!

[@chriss8825]

I am no JS expert, but in my experience JS is good at breaking itself and proceeding lines of code. I kept thinking you should just look at the browser console, or even even just copy paste known working attack to confirm nothing is borked. Not sure if this would have worked (ive only played with node with one small app), tho the way I would have approached getting the final data: Either sending it all to the console, or injecting it all into an element in the list page, or perhaps the easiest is just alert the data with something like match('CHTB.{50}') .

[@ankurverma1157]

Waiting for the video ❤️

[@Lacsap3366]

I dont't really understand why the javascript alert popup only opens two times if there are so many XSS payloads on that site.

[@vater7841]

realy exiting when you post a video,i hope someday you can teach how to investigate crypto scam with hacking skill like how they code or something else,thank you

[@0x8badf00d]

I've been screaming punctuation at the screen: "CHTB\\{.*\\}" You kept escaping the asterisk. Probably just needed to double the backslashes when using normal strings.

[@jonharper5919]

Hah I was saying the same thing. Why are you escaping the *??? On the other hand he does everything else much better than I could ever do

[@SabrinaSays]

Really awesome video! I'm just confused as to how the flag was decoded. And if we already had the coded version of it from /alien, then why did we need to fetch it through the terminal? Sorry if this is a stupid question.

[@BilelBM]

Looking at the browser console would ve helped you debug the fetch regex problem. GG

[@Zebby2013]

Who the heck downvoted this only a few min in to the Premier?

[@253nate]

A dumbass hater. Haha! They obviously don’t know who this man is. Hahahahaha! The world is so lucky we all took an oath.

[@algerienizer]

this is great, thanks!

[@JuanBotes]

thanks for making the content. \o/

[@anonanon1400]

PS1 var in .bashrc could help to fix that long pathname problem.

[@viv_2489]

Nice content as usual...

[@iliaschymas1851]

i dont want to be that guy but in 4:18 i think he is ironing a humam suit not a actual human

[@azeesabdul2674]

How to review code to find bugs

[@vineet1]

24:15 . 1 hr break lol

[@tg7943]

Push!

[@aryangurung30]

sheeeeeeeesh

[@choleralul]

Cool!

[@gtdt5666]

that was cool :)

[@mahmutivanov1204]

Keep it up,

[@cair0_]

holly molly

[@bhagyalakshmi1053]

How many times also spending master season 9 times also collection anyone 29 test collection master in the past for collecting 2 nc .lnc ......X collection master in the

[@cletusmugane]

i love you too

[@georgehammond867]

regex is some nightmare>

[@cherifxtitou6822]

i hope if one day i will have skill like y have am very jealous

[@hocmuong28tv89]

💋💖💖💕

[@fordorth]

LEARN node!

[@fordorth]

I remember when I first started watching your videos you at one point said you should not use scripts if you don't know what they do... now you just go out and grab scripts for everything and fight with them to make them work.!?

[@randomnickname00]

hey

[@MrDeicide128]

i'm glad regex destroys you as much as me

[@bhagyalakshmi1053]

Ther ck cash tp link 🖇️ password 🔑 confirmly flag 🚩

[@alawe220]

Swae Lee

[@akashkhan1988]

I would love to get your help in bug bounty hunt Can you help me please..! By the way bro LoVe From Bangladesh🇧🇩🇧🇩

[@udhavkansal3426]

Sirr big fan ❤ I want ur guidence. Plzz help And also, luv from india 🇮🇳