Laravel CVE / PHP Deserialization - "Larablog" HTB Business CTF

[@flaxeneel2905]

wow that was fun to watch, i honestly didn't know about that nginx misconfig. uhhh time to go recheck all of my configs coz thats pretty scary

[@helmchen1239]

that's exactly what i did while listening to the rest of the video, even though i was pretty sure i didn't use aliases - better safe then sorry right :D

[@Operaatoors]

I’ve always been no trailing slash guy, but now I am thinking going to be always tailing slash guy

[@masterjiggle5728]

Damn man... Its so awesome to watch you do this.. Keep it up

[@theDeparted480]

its mind blowing to see so many chrome tabs open at the same time🤣

[@MartinKrisell]

A small clarification - the .env file is gitignored because different environments uses different .env values, and to keep this away from source control, but not because we want to exclude/hide it from a production environment. Of course, there are also other ways to set environment variables in a production runtime.

[@SumanRoy.official]

Hi John, just need some knowledge that I am trying to figuring out recently, currently I am fiddling around with Java, and interesting thing I found about it was that Windows 10 does not check for Code Sigining of a Jar file but if I deploy a simple hello world written in C/C++, exe file on a different computer it detects it as a malacious file and does not let user to run it. What are the edge cases that will prevent someone from writting a Java based virus or a ransomware to go undetected by a security endpoint given the fact writing obfuscate code to prevent behavioural analysis by security.

[@justgiz]

I had no idea what was going on until the last few moments. No idea what Capture the Flag had to do with Laravel. But you're actually playing Capture the Flag. Interesting.

[@amraljaifi8792]

Thank you so much 🥰🥰🥰

[@vivekchoudhary8745]

FYI, Azure VMs are not "pingable", Microsoft for some reason removed this feature from Azure VMs

[@MattMcT]

John… lovely work as always dude! Cheers! [checks path mods]

[@Nature08405]

Thanks so much Amazing content ^^

[@JNET_Reloaded]

Interesting, any other / exploits we should know about to path our systems?

[@MrRobotUy]

👏🏻👏🏻👏🏻 Awesome!

[@tylerlwsmith]

Laravel 😍😍😍

[@phoenixzeu]

Hey John, can you do Etituber? I'm curious about the XXE payload...

[@leosnavratil3821]

What version of Xubuntu does the VM have?

[@Aolpha]

What's the cookies plugins, John?

[@fachruzi.ramadhan]

He used CookieManager - Cookie Editor

[@DcWHaT07]

Wow John your amazing!! Thank you for all the amazing how-tos! I’m curious how long did this take you to do? Your real time, keep it up. God bless.

[@Carr7.0]

great wholesom video

[@estebmun9462]

Amazingg videoo !!

[@sandra8139]

I am posting all the information of identity thefts scammers as I am building myself to be unstoppable success of my own

[@2penry2]

could you access the .env file? *EDIT* lol I was way too impatient.

[@quangvo4563]

Hey John. I wonder if i can solve these challenges after the ctf is over ?. I want to practice on my own

[@jsz4937]

kuuuurwa

[@cesaredwuardsperezrobles5458]

That was hot

[@zeepranabesh911]

Sir, I want to build a booking website using php, html and css. If I don't learn javascript is it possible to make it

[@JanBebendorf]

It's possible without javascript but it will completely suck. If you actually know php already, adapting to other languages should be no big problem. If you can't adapt you probably didn't actually understand the key concepts yet and you should dive into the very basics of DSA first.

[@GaryFrancis-q3r]

I am not super familiar with command line: what does "cat /tmp/f | sh -1 2>&1" actually do? Thanks John, your videos are really awesome!

[@HMUP7]

the output of /tmp/f is being piped to or run by sh

[@somebodystealsmyname]

It's trick with named pipes (mkfifo). With some redirection magic you get an executable to be passed over nc. It's often used for reverse shells because /dev/tcp is a Bash only feature and nc -e is often disabled due to obvious reasons.

[@ca7986]

❤️

[@SinusQuell_]

nice one

[@JanBebendorf]

What about simply reading /assets../.env? If that doesn't work, because we are speaking of php developers, there is always at least one route that can be easily forced into a 500 to get the debug screen and read the entire configuration from there.

[@raghavendrans9667]

Can you do a video of Pegasus spyware how it works and how to protect from it

[@comdeyoverflow2414]

Hey John, I notice that you always solve more web challenge in HTB Business CTF. I think that your channel root is reversing or crypto. Can i know the reason?😊

[@_JohnHammond]

I have a challenge from the reversing category and two from the cryptography category recorded and ready -- I have just been uploading Web first 🙂 Granted, I like web stuff 😜

[@comdeyoverflow2414]

@@_JohnHammond I like Web Stuff too.

[@yoshi5113]

I think, Web hacking is a good start for learn hacking 😁

[@Chezt]

That ngix misconfig is scary

[@MikeStratton]

I will no longer sleep at night.

[@ichhabahnung]

I'm sry, I found you a few weeks ago, and love the content, but I just have to say it. God: 'how many frackles do you want" John: "yes" XD love you! Keep it up!

[@alikhatab1009]

When you get access to .env you have access to the db name user + password I think you could just try that for to ssh to the server

[@sihmy9870]

Test CVE-2021-36934 Serious SAM and Hive-Nightmare

[@LasseRafnDk]

Bottomline: deny ANY file/directory starting with a dot from being accessed publicly.

[@jmjl2]

.well-known is the only exception to that rule.

[@mohdrizwan3676]

Sir please give your picoCTF class code

[@Infamous159]

I didnt know seth rogan had a twin brother who is a hacker

[@ElectroBytes-SS]

Why are you using old version of Ubuntu

[@CoolFire666]

I noticed that too. To be fair, he probably has extended support on it through ubuntu advantage, but it's still worth a small bit snickering just as a matter of course.

[@onejdc]

he also has VM image he uses for CTF/pen that runs perfectly and does what he needs to. No point in updating it....yet

[@xronnet]

you do not need to close the `?>` in php files

[@mrmarker98]

Pog? Pog? Being early-ish?

[@varadvithalkj1716]

all it took was a simply missing '/'

[@pirbaba755]

Need firebase exploit