Cloudflare CDN CSP - XSS Bypass / HackTheBox Cyber Apocalypse CTF

[@dedkeny]

Many things were learned today from Javascript & XSS to video-editing, thanks John!

[@anonymousmokona8541]

This video series got me to finally start learning pentesting - I always perceived it as something arcane and intimidating, but seeing how you struggle with node got me thinking that there is no shame in sucking at stuff.

[@timothybadenach2411]

good to see that a security professional with 10 plus years can still struggle getting up the hill, so to speak. Gives guys that are learning motivation to keep going

[@CyberAbyss007]

Thank you! I'm actually starting to get this stuff! Appreciate that you show how hard this stuff is and how much patience is required.

[@hamzabettache497]

I just like how you talk with your self and make actions :D it helps a lot : ) thanks for your videos, keep them ON.

[@sumedh1678]

Let’s give a moment of appreciation for the amazing walkthrough. Thanks John.

[@kaihuang5420]

38:08 is starting of the dulpicate of previous content till 51:58. hope you can fix it! But great job!!!! John Thanks a lot for suffering for us non-javascript fanboys.

[@dennismunyaka6537]

watching john work is like watching myself hack. I would've however given up, the live learning, googling and also building of payloads gives your channel an authentic human touch. as opposed to all other channels just regurgitating payloads from writeups. kudos

[@teddybear9152]

another video and another day of learning for me, thanks again John for all your hard work. Kudos to you for doing all this for us and still doing a day job and "life"!

[@giusepperandazzo5357]

I like your approach...it's is similar to a software engineer daily job...read, understand, try, fail repeat and so on...

[@xAngoryx]

Just found your channel and really loving your content

[@mukundbhuva]

Hey, seems like the video is duplicated from 38:08. Love from India ❤️.

[@theisoj]

I noticed the same thing. I think that John made a mistake accidentally.

[@jacobsilva421]

I love the videos where there is 5 minutes left and he's still pulling his hair out. Just knowing he's about to find the one little mistake borking it up.

[@businessgoose8605]

Like last year when I subed to you, you had like 80k followers. Keep going bro!

[@peterchari3839]

This is amazing. We learn new things everyday!!!!!!! CSP, fetch

[@Grommish]

An Ide or setting Sublime for the context you're languaging on would help. Would make the inevitable formatting errors stand out

[@diddyman1958]

I understood very little of that but it was great to see you get the flag in the end.

[@_DeProgrammer]

Using an editor like vim with bracket highlighting would prevent painful mistakes like this. Brutal! Good video tho.

[@blackjackdealer204]

I pace around my room when John releases content..

[@neilthomas1907]

ngl !! lowkey better than netflix rn

[@jannikmeissner]

Yes, I had fun! Another great video that made my day

[@kadensharpin2156]

my eyes struggled to watch John struggle through the JS

[@alandonaly457]

I always learn a lot from you , thanks!

[@chriss8825]

I am no JS expert, but in my experience JS is good at breaking itself and proceeding lines of code. I kept thinking you should just look at the browser console, or even even just copy paste known working attack to confirm nothing is borked. Not sure if this would have worked (ive only played with node with one small app), tho the way I would have approached getting the final data: Either sending it all to the console, or injecting it all into an element in the list page, or perhaps the easiest is just alert the data with something like match('CHTB.{50}') .

[@mossdem]

This has been me trying to wrap my head around 'self' the past few days in Python lol

[@0x8badf00d]

I've been screaming punctuation at the screen: "CHTB\\{.*\\}" You kept escaping the asterisk. Probably just needed to double the backslashes when using normal strings.

[@jonharper5919]

Hah I was saying the same thing. Why are you escaping the *??? On the other hand he does everything else much better than I could ever do

[@ankurverma1157]

Waiting for the video ❤️

[@algerienizer]

this is great, thanks!

[@SabrinaSays]

Really awesome video! I'm just confused as to how the flag was decoded. And if we already had the coded version of it from /alien, then why did we need to fetch it through the terminal? Sorry if this is a stupid question.

[@BilelBM]

Looking at the browser console would ve helped you debug the fetch regex problem. GG

[@vater7841]

realy exiting when you post a video,i hope someday you can teach how to investigate crypto scam with hacking skill like how they code or something else,thank you

[@tg7943]

Push!

[@cair0_]

holly molly

[@viv_2489]

Nice content as usual...

[@Lacsap3366]

I dont't really understand why the javascript alert popup only opens two times if there are so many XSS payloads on that site.

[@choleralul]

Cool!

[@anonanon1400]

PS1 var in .bashrc could help to fix that long pathname problem.

[@aryangurung30]

sheeeeeeeesh

[@JuanBotes]

thanks for making the content. \o/

[@Zebby2013]

Who the heck downvoted this only a few min in to the Premier?

[@253nate]

A dumbass hater. Haha! They obviously don’t know who this man is. Hahahahaha! The world is so lucky we all took an oath.

[@gtdt5666]

that was cool :)

[@cletusmugane]

i love you too

[@georgehammond867]

regex is some nightmare>

[@mahmutivanov1204]

Keep it up,

[@vineet1]

24:15 . 1 hr break lol

[@cherifxtitou6822]

i hope if one day i will have skill like y have am very jealous

[@azeesabdul2674]

How to review code to find bugs

[@iliaschymas1851]

i dont want to be that guy but in 4:18 i think he is ironing a humam suit not a actual human

[@bhagyalakshmi1053]

How many times also spending master season 9 times also collection anyone 29 test collection master in the past for collecting 2 nc .lnc ......X collection master in the

[@fordorth]

LEARN node!

[@fordorth]

I remember when I first started watching your videos you at one point said you should not use scripts if you don't know what they do... now you just go out and grab scripts for everything and fight with them to make them work.!?

[@randomnickname00]

hey

[@hocmuong28tv89]

💋💖💖💕

[@alawe220]

Swae Lee

[@MrDeicide128]

i'm glad regex destroys you as much as me

[@akashkhan1988]

I would love to get your help in bug bounty hunt Can you help me please..! By the way bro LoVe From Bangladesh🇧🇩🇧🇩

[@bhagyalakshmi1053]

Ther ck cash tp link 🖇️ password 🔑 confirmly flag 🚩

[@udhavkansal3426]

Sirr big fan ❤ I want ur guidence. Plzz help And also, luv from india 🇮🇳