Markdown to PDF Code Injection (CSAW CTF 2022)

[@thatcreole9913]

Great work John! This continues to be my favorite YT channel.

[@vectar]

Quite simply the best, hands down.

[@Dettune]

Literally

[@mr.picklesworth]

I love the CTF videos please keep them coming.

[@AmA-mu4si]

Always good

[@TAPCybersec]

This guy is a wizard!!

[@TheSauxer]

Talking about Snyk, you know what would be fun? Finding a vulnerability in Snyk that you can exploit to actually inject vulnerabilties into applications, into your code

[@norbalvazquez9843]

Biggest menace comment i've ever seen

[@MygenteTV]

the content you put out is just out of this world. i follow many hackers but you are out of you league bro

[@y.vinitsky6452]

You could also use rlwrap before your nc command to get a somewhat better shell out of the box

[@Hashghost21]

I remember Ippsec used the same synk payload in solving noter form HTB 😂 good work John

[@viv_2489]

Love your content always 👌🙏

[@RandomStuffGaming21]

I just discovered this channel, fantastic🗣️🗣️🗣️🗣️🔥🔥🔥🔥🔥🔥

[@accountname1047]

Love these videos

[@mochsy22]

Excellent work

[@renzoneomarmachado7555]

Awesome! I didn't know about this before. It's the first time I see a RCE with a XSS and a SSRF with the same XSS. Great job dude! :D

[@rodrilea1]

Awesome video, thanks.

[@kavishkagihan9495]

One of my boxes in hackthebox called "Noter" had the same vulnerability!

[@Asteroid10010]

Legend Hammond

[@philldevil2]

I am already using it, thanks

[@mahfoudhifatma6144]

Thanks John , nice work

[@helloguy1179]

What an amazing video!

[@YouKnowTGreen]

This was dope!!! So funny i am watching and dont have a clue what you was doing but it was fun watching..... make me want to become a ethical hacker and move from my network position.

[@CarKeyGuyNL]

after almost 30 yeqr of playing with linux CLI, i learned about ^L ... i feel stupid lol and nice one!

[@EnglishRain]

Wow you solved it super quick

[@na-sx7ji]

2:42 Hey guys, to see the code you have to click the right button on your mouse (that's the device you use to control your cursor) and select the option that reads "View Page Source" :) 15:40 aight, so I'm gonna get a reverse shell by starting a netcat listener, then using ngrok as a redirect, I will grab this bash script, set the correct variables and execute it within another bash call and done, we are in. Feel free to use stty or pwncat to get a better shell. draw the rest of the fucking owl much? lol

[@dumbidiot1119]

I feel like if someone doesn't know how to right click they should focus on stuff a little simpler at the moment

[@mango-gu5xo]

Awesome content!

[@neponel]

get any recommendations on how to do this but locally? without use of cloud servcies? want to parse pdf into markdown.

[@kundananji1]

Man! I took a break from CTF and looking at this showcase , sing me up for the next CTF

[@bigappleplug6021]

I like that shirt !!

[@whamer100]

woah that was cool, i really need to do some CTFs again

[@GalaxyAripl]

what if i have simillar ctf problem but js injection doesnt work?

[@n0kodoko143]

Thank you

[@daviddaniel4844]

Awesome 😎😎😎

[@muzamilahmed6868]

Awesome

[@HAGSLAB]

This one sounds very interesting John! Excited to watch this later.

[@dorondaniel318]

Hey guys! Can anyone explain to me why do we need the wrapping of the "bash" command? Why doesn't bash work on it's own (or sh for that matter)? p.s. great video :)

[@mauricekyalo9101]

Ik the drill😂

[@RepublikSivizien]

so, the ---js … --- stuff does the same as …?

[@lakshayautreja6704]

It's just a syntax tag (--- or ```) instead of a HTML tag

[@TheIGORGOSPEL]

I loved it, i used to be lost on it, for now I'm ready))) thanks for all Mr John)))

[@ayushoverhere]

Hmm, good work

[@MorphineFAME]

Could you slow down you're going to quack... lmao Gg, love the videos. Keep up the great work! ^_^

[@ThisPageIntentionallyLeftBlank]

Curious if you could use this to trigger a MSF payload that kicks off a Sliver Beacon followed by a Cursed Chrome/Edge remote debug session?

[@leo9.online701]

🎉🎉🎉

[@HTWwpzIuqaObMt]

First here. Awesome video keep it up

[@trap7369]

O .O great

[@jocularich]

this is cool...

[@jak365]

Cool ☠👻

[@HAGSLAB]

Very Snyky of you to use that Snyk vuln DB John! 😉 Fun challenge, I remember doing a very similar one on some other CTF or maybe TryHackMe once.

[@guilherme5094]

👍

[@olalekanadekanmbi3771]

Awesome,e

[@harshjain6256]

Hi I have a question Unfortunately I am getting electrical engineering [due to a f*ck education system] But I want to become a cybersecurity analyst Is it acceptable if I do my btech in electrical and after that Will I able to get into cybersecurity field

[@utensilapparatus8692]

John the ripper

[@jakeswick1843]

Ayeeee

[@blackhat5133]

OP

[@JUSTHACKED]

people commenting without watch video

[@tagKnife]

CTF challanges where the answer is the first result on google. YAWN. This aint a CTF its a skid playground.

[@magicboys2010]

Hey John, Are you coming to black hat event in MIDDLE EAST AND AFRICA, located in Riyadh , Saudi Arabia on 15-17 November 2022. You should cooooome!! I want to take a pic with yaa :p

[@tehwinsam3522]

John, considering cut your hair ? haha. just asking >#

[@Fahodinho]

I think it would be better to solve the challenges live, so we can see your thought process, as opposed to knowing the solution beforehand

[@AGASTRONICS]

Oops

[@Pavankumar0732]

You have not replied to my email..!

[@cirklare]

You can use pdf-parser To get information about pdf And to know if it contains malware CVE-2010-1240 Adobe reader v9.x/8.x $ pdf-parser evil.pdf | grep exe Result be like /F (cmd.exe) Then it's a malware