GoogleCTF - Cross-Site Scripting "Pasteurize"

[@frankfernandez1957]

John: Im a newbie, still have a lot to learn Me: *sobs*

[@ucheugbomah2228]

me too 😂😩

[@mrhappysmiley2968]

This was incredible! Loved it! Never seen a challenge like this. This was very valuable to me. Please make more.

[@granitbajraktari1600]

Just a heads-up: at 19:40, when you wanted to only POST to the first URL and then follow the redirect without POST, you could have just dropped the "-X POST", since "-d" already implies POST, and curl would have followed to the redirected URL with GET.

[@christianrang5782]

I really enjoyed seeing the thought process. This was one I was super close to solving, but I'm a noob at XSS. I didn't know any cool tricks like shown in the vid. Keep up the great content!

[@rodrigo1300]

A lot of people out there try to portrait something that they aren't and seeing someone like you being honest about not solving this CTF. Respect

[@novanuke1356]

I think I need to start reading more writeups. I've always tried to do a CTF and if I can't get it after trying for some time I guess I usually walk away and I end up not actually learning from the CTF which is the point. Great video man!

[@AdiSings2023]

ye. the struggle is real

[@padaloni]

That was actually super awesome. Thanks heaps my bro. love your honesty. that was not an easy challenge. you're such a smart dude it's kinda nice to see you need the help of others too.

[@LESLEYYY0]

Would love to see you do the other ones :p

[@SiyuJiang]

Your content is great. It’s easy to follow, and I really like the perspective that we get when you show how you think through the challenges

[@krlst.5977]

Real good explanation, i came here from LiveOverflow where he covered this CTF and mentioned yours explanation and, no offense for LiveOverflow :-), now i got it much clearly. Thank you!

[@ibragimabdulazizli4230]

Wow! You are the one who leads to how to think as a hacker. I searched looots of sources to learning CS. And you are my fav. Thankss

[@BCRooke1]

The b/1337 is just a reference to a bug ID. At Google they use an internal bug tracking tool called buganizer, and short links are in the form of b/bug-id. Usually you see this in the code: TODO(b/5746327): fix foo

[@ancestrall794]

I thought 1337 meant LEET

[@userou-ig1ze]

@@ancestrall794 that is what it stands for...

[@Brontosauredumarais]

Thanks John, super interesting! Can’t wait to see the new challenges you are preparing!

[@liamlouw4643]

John ima need you to chill on these videos, my sleep schedule can't take it!! Loving them man, really fun to see your thought process!

[@mossdem]

This really helped understand XXS properly. Now I feel I can learn a little more! I would love to see a little shortcuts video. You fly around a terminal and subl! Maybe even just a little write-up, just a thought but great video

[@Stupid_Money]

Definitely a good beginning point to have your video on ctf. I just became proficient in Javascript a couple months ago and being able to follow along with this task really motivated me!

[@nft_explorer]

You are so so good man, its interesting to watch your videos and learn from you.

[@maoropizzagalli4153]

Glad to see I'm not the only one you get discouraged when those things happens. Lesson learned I hope, Thank you papa for the teaching

[@LUKESLYTALKER]

I’m getting buff doing all these cURLs bro!

[@exoooooooo]

You are very kind and humbly willing, to tell the truth when you solve this with the help of others. It's not like someone there who considers himself as "a hacker that your friends told you about" but is only good at making videos and making up a tale.

[@harshrai6259]

Really insightful video 👍 and now I want the pleasure of finding those flags I feel so lucky to have a node js and js background

[@ryansoma6782]

Thank you ! , can't wait for another google ctf web challenge video !

[@newuser2474]

First time motivated by watching your video

[@cam545]

I'm here for the F U L L F R O N T A L honesty. 13:30

[@claythearc8342]

You may have answered this later in the video but b/1337 or any number is generally just shorthand for Bug 1337 or Bug whatever that's being tracked on some external issue tracker.

[@ch33zer]

The b/1337 refers to a bug on Google's internal bug tracker, commonly accessed on the intranet at b/$bugid. I'm surprised they left this in for an external event. Source: I'm a google employee :)

[@rootdev8106]

At first I assumed the solution was to post because .slice(1, -1) would only remove the outer ;) Nice video, keep it up!

[@gaurav1565]

It'll be really nice if you did the other web challenges as well. More than the solution seeing the rabbit holes and methodology of sorts is really important.

[@dylanhess4906]

Thank you for this video please post more of these

[@yoshi5113]

Thanks u Sir.. love the way you explain all the stuff 👏👏👏

[@akashrakshit8446]

Wow dude thanks 👍🙏🏾 loved it

[@JustFun-dj3pq]

Great walk through, love your video

[@xFreeman4]

Pretty Nutz! Keep up the good work man!

[@ta8ta841]

more google CTFs will be appreciable

[@KDevGaming1921]

Thank you for this learned a lot from this video.

[@orange6946]

Actually really interesting. It did strike me as odd that he used JSON.stringify when there was really no need, but I would have never looked much farther than that. Good content!

[@bazboz1468]

not disrespect you, but mid vod i had this idea 💡 of a drinkin game, when ever you say peculiar we take a shot 🥃 now i continu watching i love what you doing btw keep up the good work ❤️

[@adhilazeez6039]

Awsome bro... You're inspiring us... Thank you.

[@KaleshwarVhKaleshwarVh]

I lost it when cookie and hookbin came up. I'm weak there.

[@abhisurwade]

Appreciate the video walkthrough.

[@ServusChristi777]

Ed Sheeran really is talented.

[@FunnyVideos-fd3ts]

Lol so relative

[@q-bert558]

Thus was incredible!!

[@rafaelgontijo5792]

Absolute amazing!

[@Dogelition]

I think the Tracing challenge would make for another great walkthrough video!

[@somebodystealsmyname]

Hey John, take a look at webhook.site, I think the UI is much more intuitive for XSS/SSRF/CSRF.

[@eeengoh5189]

It doesn't work on hookbin for me for some reason, but webhook does ! Thanks for the recommandation !

[@arshiyakhan6789]

Thank you bring more these kinds of ctfs and python scripting.

[@Ulyeney]

Thanks, John

[@4ag2]

Amazing content always! I struggled so much last weekend hopefully I learned a lot!!! thnx

[@Wakkas]

Hey John, I'm an officer for the Cyber Security club at my university. We would love if you could come in for 30 minutes and give a talk about some pen testing or any networking exploits that are interesting to you!

[@_JohnHammond]

Feel free to send me an e-mail, I'm always happy to hang out! :)

[@ziil7525]

very cool ctf real video, thanks man.

[@h8handles]

My name is, what? My name is who? *imitates turntables zickazicka john hammond *to the tune of my name is slim shady*

[@captainsalazar7166]

Sir please tell us how did you install that sublime build view? I am looking for it but couldn't install it. I am using sublime text 3

[@ratatouille7301]

Hello, thanks for this video. How did you know about the "[ ]" in the "content[ ]" ? How can I find it if I'v never seen it ?

[@Dogelition]

If you look at the body-parser documentation here: www.npmjs.com/package/body-parser It says "The extended option allows to choose between parsing the URL-encoded data with the querystring library (when false) or the qs library (when true). [...] For more information, please see the qs library. If you follow that link, you can see a bunch of examples for how it lets you parses variou query strings into objects/arrays.

[@kyngcytro]

Dude I didn't even know something like hookbin exists thanks John and yes I'm a John too 😅

[@peterarbeitsloser7819]

#commenting_for_the_algorithm You are great John!

[@siddharthjohri2935]

Very Nice video just as always. Stay frosty.🥶

[@shivambeeyani6758]

for the algo Always love your videos, especially because I'm shit in web challenges

[@mina_ashraf]

Hey John, Amazing content as usual. I have a small question, where would you recommend for a python beginner to learn the necessary libraries and tools? Do you suggest a specific course or a website to learn the tools that you usually use such as pwntools, Crypto, requests, and so on? C++ is just not the tool for something like this

[@moriartyshelby1618]

something never be changed..: "Hello, my name is John Hammond.."..NICE

[@dlcrdz00]

wow...it always amazes me how much information and syntax you input for the CTF. How did you learn all this stuff? haha

[@nmg555w]

note that sending the object using the url encoded parameter is only possible because of the `extended=True` bit below the comment saying "we need this for the captcha for some reason" :) (understanding this was for me the clue that helped me solve the challange)

[@erickgiffoni]

that was very cool ! thanks !

[@domaincontroller]

disclaimer 01:30

[@nicktm2005]

great tutorial ... like always ... thank you

[@jimanky]

Thank you so much for sharing your knowledge. +1 sub

[@tecdom]

Muito bom!!!!! Grato por compartilhar seu conhecimento. Aprendo muito com seus vídeos.

[@amellcotts6650]

Please continue doing those.

[@Hanhan099]

we want more

[@R4B3326]

Missed the live Stream, but loved the video!

[@ChupoCro]

How come the microphone character 🎤 @7:10 in your Sublime is in color?

[@nessiev780]

Hmm, i really dont have a clue about anything going on here, but i still watched it

[@NoONE-bk7ud]

i like how said i'm not that good

[@matthewshen]

This was the only challenge I got. Can you also explain some other challenges as well?

[@immyslave2952]

thank you so much!!!

[@tears_falling]

feels good to know node

[@muhammadbellabuaynunyai2754]

I love you solved this problem

[@maxxxy910]

YESS PLEASE DOO MORE OF THESEE PLEASSEEEEEE!!!!!!!!!

[@mahfuzkabir7812]

This was great!

[@amir.m5550]

you are great.👍

[@whistletoe]

keep up the good work!

[@Smilin_Chris]

Commentingforthealgorithm

[@sontapaa11jokulainen94]

Replying for algorithm.

[@_JohnHammond]

You're the best! Thanks so much!

[@SeanCMonahan]

Commenting the flagorithm

[@mr.meatbeat9894]

Thanks dude!

[@Hexbyte965]

Awww, I missed the live stream.

[@inginerdemulslapte9378]

Johnito, thank you for you video!!!11!!!!

[@_JohnHammond]

Thanks so much for watching!

[@krlst.5977]

The one question how it supposed to get where issue is by this "b/1337"? I know it means leet but how it leads to JSON.stringify row of the code, can someone explain please?

[@bruh_5555]

Why does log-me-in above pasteurize in the challenge list have only 7 points or has it been solved by too many people or my eyes aren't working??

[@tenex]

I really liked but I got list and cannot understand how figured out the double slash

[@a_personlol894]

Cookie Monster does not approve of all the cookie stealing going on here.

[@website8362]

Writeups ❤️

[@farjamfarahbakhsh9030]

when did Ed Sheeran become interested in IT?!! JK :)) Thanks John for good content.

[@msalih]

awesome!

[@BrainFood155]

So was the "JSON.stringy()" portion unnecessary? It doesn't seem like your exploit at the end used what you learned from the JSON.stringify()? Or am I missing something?

[@zwiebelopi9898]

Vincent Zhen Did you actually watched the video? He was creating a post request and assigned an object to the content parameter. Because it’s an object, Json.stringify allowed to break out of the double quotes.

[@BrainFood155]

@@zwiebelopi9898 I did watch it but I don't know JS very well. I saw that he was sending an object via the POST request but I didn't understand how `content[]=` was the object in the JSON.stringify(). I think I get it now though. Thanks

[@dralfonzo24]

"what is 1337" lol

[@Dilpreetsinghbaath62]

Leet

[@cameraman1939]

It might shock you but it's a number..

[@yakonick]

Yo In Russia it was (maybe it's not anymore, it was a long time ago (about 10-15 years) ) a "true young Men number" 13 - your age 3 - your average mark at school (max value is 5) And finally, 7 - the number of your class at school

[@karanagarwal282]

Please provide links to the writeups you are talking about....

[@karimmohamed3744]

Loved it

[@gopalmore315]

Excellent

[@scottch4444]

does this man really not know the fable of 1337

[@MrJCollector]

Please do the REV beginner ones!

[@ElliyahuRosha]

Hi, john. Can u point me to an article which discusses when tp use request.session() and when request.get/post() ? Thx

[@schneidervillageschneiderv6975]

please create more of these