HackTheBox - Lazy

00:39 - Basic Web Page Discovery
03:30 - Examining Cookies - Pt1 (Burp Sequencer)
05:05 - Fuzzing Usernames (2nd Order SQL Injection)
07:15 - Examining Cookies - Pt2
07:40 - Cookie Bitflip
12:45 - Oracle Padding Attack - Pt1
15:30 - Rooting the Box
22:50 - Oracle Padding Attack - Pt2

[@Layer8Conference]

One of my favorite things about your videos is that you make mistakes, admit it, don't edit those out and show workarounds. We all run into snags and all to often, youtube tutorial videos only show a clean path. What you show is great because it is the same types of issues that we run into and you show a solution for even little mistakes. Whether it's a typo you did or the box not playing nice, it's always good to see. Thank you.

[@sullivancastiel4780]

you probably dont care at all but does anyone know a method to log back into an Instagram account..? I was dumb lost the password. I appreciate any tips you can offer me.

[@hugojayden9376]

@Sullivan Castiel instablaster =)

[@sullivancastiel4780]

@Hugo Jayden thanks so much for your reply. I got to the site on google and Im in the hacking process atm. Takes quite some time so I will get back to you later when my account password hopefully is recovered.

[@sullivancastiel4780]

@Hugo Jayden It worked and I finally got access to my account again. Im so happy! Thank you so much, you really help me out :D

[@hugojayden9376]

@Sullivan Castiel You are welcome :D

[@neoXXquick]

I learn a lot from every video you post.. thx for sharing...

[@candyman8451]

thanx man. This is awesome and learning every day new techniques thanks to you! Thanx again!

[@filipdragovic2665]

Man you are just awesome!!! Learned so much things from you!!

[@mabalito]

Your first chmod to set executable bit on cat was with capital X, that's why it didn't work..

[@ruhruhruhruhruheisjsij]

You should make a video or series on how you learn this stuff. These ctf's always stump me but you seem to always nail them with ease.

[@ippsec]

It’s difficult because I’ve been doing this type of stuff for over a decade, so just have a really strong foundation. Additionally, i started out as a sysadmin so had a different starting point when going into security

[@creedx8407]

Watching this one in 2021 lol almost all video i watch it

[@berndeckenfels]

It does the explode to extract the username from the cookie I guess, so it results in "user=admin=" -> "user","admin",""

[@Hozzizay]

host is down so gon' sit back and watch this one

[@marcobrandoni8433]

Thank you so much for this wonderful video. Lots of things learned today too.

[@the_terrorizer]

It's like getting to shadow a senior pentester at work for free, whenever you want, on countless engagements

[@jlxip]

Thank you for uploading this and sharing your methods

[@rastamouse4946]

I solved with padBuster, but that bit flip thing was a nice tip :)

[@securitywarrior7989]

sir you please also show your solution writeup

[@ippsec]

padBuster is in this video as well :) -- Just do it later as it takes some time so padBuster was going in the background while i privesc'd.

[@paired7815]

Lots of new things to learn ...i brute foreced the admin using hydra , then used dirtycow

[@flofgr575]

Love your videos! Thanks :)

[@howto...6298]

can you help me out with the Under Construction challange... i dont know where to look :(

[@dawnsix]

Can someone tell me why creating a new cat script with #!/bin/bash does not give root, while #!/bin/sh does?

[@alexstoubis890]

Πως τους πετσόκοψες έτσι!; 15:30

[@xandercage740]

Hi @Ippsec.. Love your videos.. Great explanation.. One quick question though.. Could you please guide me how to get this mindset of thinking in the right direction and info of tools and working knowledge of how a particular service works. I am trying hard on my OSCP. One thing I found is no matter how much I learn there is something new always. Please shed some light on how you started and your working knowledge. I wanna get an inside of a hacker's mind. If that makes sense.

[@thomaseof2466]

The basis is having a good methodology to cover as much of the attack surface as possible. After that experience and knowledge of all the common services could be very beneficial.

[@xandercage740]

Thomas Underhay right.. But sometime the path is too confusing.

[@ippsec]

Hard to say. I was a sysadmin for a decade, so I've spent a lot of time digging into random crap to find silly errors. Thomas EOF said it pretty well. Hacking is more of an art than a science. If you try to cover everything in any phase such as enumeration, you'll never finish. Need to know when you have enough to move on.

[@xandercage740]

IppSec so experience matters a lot!

[@justaguy3158]

.Legend!! Thank you so much

[@saubhagyasrivastava1241]

Great stuff! :D

[@tyleraustin8134]

Do you have a terminal add-on? How do you swap terminal sessions like that? I really like it, because I am not a fan of terminator.

[@km0x905]

He use tmux , see Popcron Video

[@tyleraustin8134]

Thanks!

[@barserbey7123]

why in shell not working with #!/bin/bash but working #!/bin/sh. bash and sh similar...? i can not root with #!/bin/bash but im root #!/bin/sh in own cat script?

[@energy-tunes]

Great beginner shell

[@DefinitelyNotSr.S]

Anyone could explain me why the "admin=" register worked? I don't get the "explode" part in the decrypt function. Thanks. Edit1: Could be the case where register process accepts "=" as a valid character, then it creates the user "admin=" but when it tries to login "admin=", it remove all the "=" and login as "admin"?

[@paulrobertson9731]

Where did you find the decrypt function? I also want to have a look, as i'm not sure why the admin= works.

[@MrIamedible]

Bit late, but essentially the explode function within php splits a string into an array based on a delimiter (in this case '=', so in the standard usage, the encrypted string is 'user=john' which becomes an array of "array('user', 'john')" what list does is assigns those indices within the array to local variables, so in this scenario $user variable becomes 'john' as the 2nd item in the array is the value 'john'. In the case of 'admin=' the encrypted string becomes 'user=admin=' since '=' is the delimiter it becomes the third item in the array, so 'user=admin=foobar' would create an array of "array('user', 'admin', ''). So it effectively strips any of the delimiters from the string. In php: php > $f = 'user=john'; php > print_r(explode('=', $f)); Array ( [0] => user [1] => john ) php > $f = 'user=admin='; php > print_r(explode('=', $f)); Array ( [0] => user [1] => admin [2] => ) Hope that helps!

[@darwinyu4171]

@@MrIamedible Very helpful !!

[@TheAmzuk]

@@MrIamedible thanks for such clear explanation

[@aidenpierce5397]

what's the point of adding a bunch of space behind admin?

[@happyharry2145]

trying different stuff to figure out what he's allowed to insert in that input

[@sarrcheikh9095]

Great tutorial but next time try to zoom enough because it is difficile to read what you key in.

[@correabuscar]

hash -r , for the cat issue

[@pratikktejani9655]

I am looking for step by step tutorial regarding shellshock. If you have it then kindly upload it as soon as possible.

[@ippsec]

I do shell shock in beep.

[@7Shol]

From 17:20 i have no idea what you're doing :/

[@happyharry2145]

he's using the gdb debugger to look into the (backup) program as it runs and see what it's doing then he figures out its running the command (cat /etc/passwd) by reading from that address from the program , then notices that the command is using relative paths instead of absolute path so he then adds his own path to the variable $PATH so his program (which is also named cat) runs first and his program is a script that runs a shell (/bin/sh) thus giving him a shell as root

[@KshitijGunjale]

Wow awesome I tried both tricks on HackTheBox - I know Mag1c but its not working :'(

[@RowanSheridan]

kzbin.info/www/bejne/aYfbi4Gcoa-kqdk i think it didnt work as you used a capital X instead of lowercase x

[@Sachin_Sinh_Chouhan]

i need your help regarding my crypto wallet dat file i need its password how can i contact you