HackTheBox - SneakyMailer

[@shellbr3ak443]

The Extra part of the video is AWESOME, can't thank you enough for these amazing videos.

[@timkatsapas]

That stupid pypi package tripped me up. I was trying to reverse shell but kept having syntax errors. *TRY HARDER* . Thanks for the awesome video. Damn you are fast at enumeration, sheesh.

[@mrd7901]

Saturday means IPPSEC videos ❤️❤️, lots of love sir ❤️❤️😍😍😍

[@veritatas678]

That php webserver part at the ned was really helpful

[@oriel360]

love your vid and explanation, keep up the good work

[@Deaple]

Wow this last tip to use apache's http thread for enumeration blew my mind

[@mehmetux4186]

nice tutorial again. thank you ippsecc. sometimes I also make writing mistake but I can't find my mistake quickly.

[@jessee_jonessss]

I have been waiting for another video for sometime now. Thank You

[@0xtz_]

The first , amazing 😉

[@AhmedAbdullah-pp2mp]

سبقتني lmao

[@0xtz_]

@@AhmedAbdullah-pp2mp hhh

[@techlegoblocks62]

Great video, why you mentioned you dont crack in the same box / VM? just curious on best practice on this, sounds interesting to set up a box only for this, got a spare Pi :)

[@ippsec]

Cracking can be very cpu/gpu intensive. You want it to work as fast as possible. Doing it on the machine you are doing other things slows it down. Pics aren’t good for this because they aren’t that powerful

[@techlegoblocks62]

@@ippsec awesome gave me an excuse to set up.something new. Each video is a library of knowledge, thanks!

[@celikom]

Awesome !!!

[@j4ck_d4niels]

Sat night with ippsec, always fun :)

[@nikohegeheiskanen]

Man i went full telnet on this box :D made a python script to send all the mail using pwn tools and manually checked the mail with telnet too :D

[@highlightchannel7845]

Voice of a legend

[@ninostephen]

The thing with thunderbird is that it sometimes fails to determine the correct configuration values while setting up the account. It's usually DNS. Could be others too. The solution would be to manually set the values. By values I mean the port, server hostname, ssl and stuff. Setting it to the non-ssl values would resolve the issue 🙂🙃.

[@omran.alshehabi]

Learned a lot as usual, thx

[@azelbane87]

Awsome

[@magbenyo]

i have been waiting

[@JuanBotes]

Thanks IppSec

[@gauravpurswani6671]

I think instead of using some tool for ftp-user-enum we can just create a 5 line python script, with socket programming and if else statement. Please Let me know if I'm wrong. Thanks for making such amazing videos. The way you explain things is 🔥🔥, I have learned a lot from your videos...

[@ippsec]

Yes. I believe I mention you can do that, the purpose was not to show how to code the entire enumeration piece yourself. It was showing how to put some middleware together in order to use existing tools in unintended ways. Which greatly speeds up the time it takes to fuzz simple things. I think most people try things like you mentioned and write the perfect script. However, when working against a clock this isn't always the best way.

[@gauravpurswani6671]

sorry maybe I was not attentive in the part when you were talking about the script, I will go through the video again. Trying the tools to use the way in which they are not intended, to achieve something else, sounds supercool. I will start doing things in that way. Thanks for replying!😄

[@aminhatami3928]

TNX.❤❤

[@Sleep-travel]

Love from India 😍😍

[@williamwambua7710]

You should most definitely make a tutorial video for us dummies!!!

[@LoayMatar]

I still don't understand how a user clicked on the link... obviously there aren't real users, so how did he get a click on the link in the phishing email?

[@Max-mz3is]

24:39 Port 465 smtps is closed, How were able to connect via 465, it should be default 25?

[@LoayMatar]

So that means that it was probably wasn't closed, it just didn't show up in the nmap scan because the scan was for the top 1000 ports, so maybe 465 wasn't in the top 1000 port. Maybe if he did -p- to scan all ports it would have showed up.

[@Socversity]

It’s awesome. But why don’t you create course on it? For example, make a video on smtp, explain, why it’s important. What kind of things we should look for, what are common misconfigurations in smtp. Honestly, it would be appreciated. If you can start a short series on each service which can be exploitable. Thanks

[@ippsec]

Go to the HackTheBox academy for that type of stuff. academy.hackthebox.eu

[@Socversity]

@@ippsec thanks, but I couldn’t find such kind of stuff.

[@ippsec]

Nothing SMTP but that is where you can find it when/if I do create it.

[@Socversity]

@@ippsec thanks, appreciated 👍👍

[@MaximusHyde]

isn't ippsec doing enough for you already?

[@mossyhorn2147]

@IppSec why don't you like cracking on a VM or your host computer??

[@kathib2571]

does watching this help to gain better IT-skills to get a sysadmin-job or else? or would it be wiser to watch something else?

[@CJ-rt8zy]

nope

[@kathib2571]

@@CJ-rt8zy something else?

[@abdosama]

FYI The password you got "soufianeelhaloui" is a moroccan nameand last name :)

[@ahmadhama2491]

3:40 "it looks like we have Nginx running on php" LOL thanks ippsec for the great video again

[@kret63]

That was sneaky :)

[@GabrielHenrique-yl3jc]

What is your operating system? What is your operating system theme?

[@mhamadyahya1]

What operating system you use? Parrot or kali linux?

[@element-1254]

In this video he is using ParrotOS.

[@vonniehudson]

Expert use of man pages

[@SaurabhMeherX]

Can someone please tell me why do we add the url to /etc/hosts file

[@ippsec]

Look up Virtual Host Routing, it’s just a way for a webserver to identify the site your going to

[@nikohegeheiskanen]

Also look into how dns works 👍

[@Zygorg]

23:10 port 443=993?

[@elchinefa9524]

he confused with https but 993 is ok it is for smtp ssl/tsl if i do not make mistake.

[@GC-qe8vc]

Ippsec your content is great, but try slowing down a bit! You are missing obvious error messages in your effort to type and click as fast as possible. There's a false impression out there that 'good hackers type 300 wpm and never look at a GUI window for more than 50ms' but that's in Hollywood not in real life. Anyway, thanks anyway...

[@tymekl1509]

I don't know if this is for linux, but I used it for a long time, and it works, so.... yeah (Email client) www.oeclassic.com/