HackTheBox - Ouija

[@AAHyo]

Always when I hate myself, I'm watching ippsec's insane box walkthroughs, so I can feel even more stupid

[@GajendraMahat]

😂😂😂

[@KohzmikYT]

Idk how people think of these, I can barely do a medium box, let alone a insane one. You're insane ippsec, much love from south africa

[@Siik94Skillz]

Experience... thats how

[@pavi013]

Even if you can't do the box, its good to take all the knowledge.

[@ASoggySandal]

Me shouting at my pc that burp was adding the carriage return haha. You can see (and edit) it nicely in the inspector table on the right when you highlighted it.

[@antoniob.6515]

Insane… ❤I cannot even imagine how much you have studied to reach this level

[@NatteeSetobol]

Awesome box. I wish we could debug the HTTP smuggling part so we could figure out why it was acting the way it acted when you added a third header. Also, I used xclip -o > file.txt to paste into a file in a terminal and use tmux loadbuffer - to load data in the tmux buffer. Thanks for the video!

[@csgosmoke]

I give up on this one because I can't able to get the foothold but hey thanks for uploading this will try to understand where I lack

[@genelkanininaksine]

Ippsec the legend

[@AUBCodeII]

Hi Ipp, today is my birthday :3

[@ippsec]

Happy birthday!

[@AUBCodeII]

@@ippsec thanks! 😊

[@o1-preview]

man, I love some aspects of this box

[@thedude4723]

My head hurts

[@elcapitanodeltimbuktu1O1sir]

Its Gonna Be More Fun If Using HTTP/2 Pipeline 😊

[@ujsimrananees]

Could you point to a resource where I could study more in detail about this Hash extension attack?

[@berthold9582]

I never click on an insane box 🤧

[@takatoekoe]

what certs do you have?

[@sponge5643]

The best.

[@tg7943]

Push!

[@Giyosiddin_dev]

Good !

[@george___43]

Awesome!!!!

[@coltonthomas3658]

How long does it take to do a box like this?

[@Darius1013]

It depends on your skill level - if you understand basic concepts and how stack works - it takes few hours to get foothold and pwn root, but if you have lack of knowledge in some parts - you can spend at least few hours filling your gaps (and i'm not talking about basic tooling, but more how stack handles stuff - in this case you needed to understand HA proxy overflow and do debugging on lib file - if you already run into this HA exploit - its way easier, if you did other debugging - again - not so hard as start from 0). So i would say on average it can take from few hours to few days - depending on your skills - and if you can't do it in few days - you're lacking basic skills on some specific parts (you can train them on easier machines), or missed something - can't find anything in day - check your notes again, try different angles and finally rabbit holes - you can dig deep where is nothing - it takes time, and give 0 results, but sometimes you can find unintended ways to hack the box, so idk, maybe they are not so bad.. Funniest part is adventure, so just try and if you fail, you still learn something and will do better on next one :)

[@AUBCodeII]

xct, currently ranked #1 on HTB, took 17 hours, 50 minutes and 57 seconds to get system blood.

[@maniakdemi3548]

Awesome

[@ihavelowiq2723]

in here i don't understand this. (!(d(q.headers['identification']).includes("::admin:True"))) in this check, d() returns value. how to check admin:true in it?

[@ihavelowiq2723]

i ran the code and it just works. :|