HackTheBox CA CTF - Using Snyk to Find & Fix Vulnerabilities

Seriously, isn't Snyk SUPER COOL? Check it out! snyk.co/johnha...
Exploit Goof, the vulnerable web app! github.com/sny...
00:07 - BlitzProp HackTheBox Cyber Apocalypse CTF challenge Intro
01:00 - What is snyk?
02:36 - Snyk can be FREE!
03:34 - Connecting Snyk to Github
04:54 - Discovering Goof, the Vulnerable Web App
07:28 - Deploying Goof
09:14 - Interacting with Goof
10:00 - Finding Directory Traversal/File Access
11:22 - Snyk Vulnerability Database
13:22 - Patching Vulnerabilities with Snyk
19:52 - Pivoting back to the HackTheBox BlitzProp challenge
20:58 - Finding Prototype Pollution and RCE with Snyk
21:41 - Deploying the BlitzProp challenge with Docker
22:52 - Exploiting the Prototype Pollution vulnerability
26:32 - Using Snyk to Patch the Vulnerability
28:38 - Validating the change with our exploit
29:21 - Wrap Up & Thank You
Hang with our community on Discord! johnhammond.or...
If you would like to support me, please like, comment & subscribe, and check me out on Patreon: / johnhammond010
E-mail: [e-mail]
PayPal: paypal.me/johnh...
GitHub: github.com/Joh...
Site: www.johnhammond...
Twitter: / _johnhammond

[@dajiru1976]

Thanks to this guy I put my hands on keyboard, Learning all nights a bit of hacking. Thanks John.

[@MakN.]

I just started. Very fun but a bit overwhelming to begin with!

[@dajiru1976]

@@MakN. just be patient. I suggest to start with picoCTF and use Google a lot. The point is to learn. Even check the write up. Try to find a similar problem and try to solve by yourself.

[@MakN.]

@@dajiru1976 Thanks :) just done my first hackthebox today with some reverse tcp. Slowly slowly 😁👍

[@ko-Daegu]

@@dajiru1976 what picoCTF you started with what challenge?

[@UnknownSend3r]

@@MakN. what's your background before doing the first CTF

[@1anre]

This was both refreshing and humbling. Didn’t know such easy-to-learn tools to get into the AppSec space even existed or were this accessible. Would be great to see videos on your Career, how you knew Security was for you, & what you do to keep up to date with the latest trends in this Space.

[@mossdem]

Wow Snyk is awesome! What a great idea for security programs for startups and projects and even better it’s open-source !

[@kopuz.co.uk.]

Yeah it seems to be a pretty good info-sec service, although a bit of a logistical nightmare for the devs.

[@mossdem]

@@kopuz.co.uk. haha I can only imagine the headaches 😂

[@1anre]

@@kopuz.co.uk. But it clearly points out where in the Dev’s code they need to take things a bit more seriously and learn from as they develop in their software development career, what’s so bad about having such a proactive tool that still spoon-feeds you on where to look in your code specifically at your disposal?

[@VivekSingh-ve5pr]

Thanks for bringing up super cool videos frequently. i'm always excited to watch them out

[@dajiru1976]

Me too

[@TomDoesTech]

I saw the thumbnail and thought "I need to see Ed Sheeran fixing vulnerabilities".

[@shabnashummer645]

Thanks John , You make me realize how vulnerable the apps we have developed . We were only focusing on the end-user requirement .

[@lepsycho3691]

I would have prefer you to disclose the sponsorship at beginning of the video not at 20 seconds from the end. Otherwise great demo and a lot of potential from using snyk for CTF!

[@1anre]

When are you making your own tutorial video so that you can announce your sponsorship 10secs into the video? Secondly there nothing wrong with sponsorship as long as the tool does what it promises. Don’t see why folks think every KZbin that snags a sponsorship deal means he’s selling a bullcrap product and forcing it down people’s throats.

[@lepsycho3691]

@@1anre I never said that sponsorships are wrong. But if you follow the ftc guidelines, it should be HARD to miss. Therefore, my critique stands, make it so that it is known at the beginning of the video and not the end.

[@0dayCTF]

SNYK is OP ❤️

[@ameer2942]

Hey look... Guy from THM

[@kherkert]

For next vid, please fix your mic settings. Listening through headset. Audio is clipping badly. Turn that gain down a bit 😉

[@wilcosec]

Great ad, John! Thanks for putting this together. I hope they paid you BIG $$$ for that 1/2 hour ad.

[@1anre]

Nah. The tool does what it’s suppose to do. Get a life

[@JustFun-dj3pq]

Super cool ! Great video as always bro

[@oldGoatMilk]

It premieres at 3am for me I have to watch it when I wake up.

[@scarlett6761]

Don’t forget to register your copy of Sublime Text 😄

[@stephenmount6181]

@John not to discredit Snyk and similar tools that I'm sure do more than check your dependency management (e.g. trying RCEs using libraries that are used like what they call ImageTragick), running `npm audit` and `npm audit fix` would capture what is in this video.

[@1anre]

Can you do a video to show all these clearly?

[@Bananananamann]

Now add backwards compatibility to the mix! I see how this could work in a CI/CD context on new apps though.

[@ventordicissimo]

Very interesting topic. I have to say tho, the audio is a bit clippy

[@MrFontaineInc]

This is definitely a legit tool!! I hope to see more iterations of this in the future as the importance of "shifting left" becomes the norm.

[@droidsino8072]

Thank you for everything you do 😊

[@georgesotiriadis2763]

Amazing video again john. I have a question in order to understand all that kind of web attacks is it better to know the technology like building a node app or php app and see why the vulnerability existed in first place? Like No sql injection etc.

[@jorisschepers85]

Could you use this in a King of the Hill to hold off the others?

[@SirHackaL0t.]

I enjoy your videos but your mic is either too close to your mouth or the signal is a bit hot causing distortion. :)

[@joshr9730]

Diggin the shirt, I have one myself :D

[@mk_r4zy450]

what application launcher are you using? :)

[@rajarshibasak559]

Bro, I am in depression after seeing your couple of videos.. So much I have to learn..I was thinking I know something about hacking, now it seems I know nothing😞

[@1anre]

Hahaha. 1yr later how has the learning journey been? Hope you’re less overwhelmed and can teach us a thing or thing from what you’ve picked over the last 1yr?

[@quentinh.9978]

Don’t sub or like non music but love the video

[@logiciananimal]

I'd love to see Snyk target Mutilidae or Juice Shop or one of those

[@1anre]

What are those particularly?

[@logiciananimal]

@@1anre Deliberately vulnerable applications for learning and illustrating vulnerabilities and flaws in software.

[@michaelguier2053]

yea synk is also incorporated into chromes dev tools.. if u run lighthouse tests it gens that report and refers u to snyk too good

[@rahulsharmar1]

Hey from where can i learn python scripting? like to automate tasks and make tools. can you suggest some good resources?

[@DahlFreeman]

Dope!

[@samoconnor3633]

I'm literally making a web app vulnerability scanner right now for my a level NEA project wow 😂

[@UnknownSend3r]

What's a level NEA project.

[@samoconnor3633]

@@UnknownSend3r I'm currently studying computer science at alevel, a part of the spec is that you have to build a piece of software which is called your NEA (non examined assessment)

[@Dedseq]

sick!

[@ArthursHD]

Nice!

[@whoamisecurity9586]

Hello 👋

[@Tekionemission]

(11:05)-Encoding

[@PermisSecurity]

ippsec vs john Hammond pls

[@BlRaidX]

You hit ignore on most of them.

[@OK_NOK]

KOTH Nuke button

[@psd00m]

[@vladostema]

We need some kind of script that scans real url and find how to hack it

[@1anre]

No you don’t.

[@kbharathi1183]

Sir is there any giveaway

[@SONGOKU-tl3ht]

Tool is cool and all, but mention "includes paid promotion"

[@djorngougenhimer7455]

Have to give it a dislike as you don't say it's a paid promotion/sponsored video till the end, basically an advertisement. Makes you look dodgy/questionable/untrustworthy Have seen a couple (read 2 or 3) your other videos and they were interesting, but this make me question your integrity.

[@1anre]

Nah. Flawed criticism. If he didn’t even mention it in the video in the first place, would your wise self know or will you be able to throw any tantrum then? Doubt it Enjoy the free content and move along

[@_ShamsPathan]

Someone hacked your youtube channel? Is it a deep fake video?