XML Object Exfiltration - HackTheBox Cyber Apocalypse CTF "E. Tree"

[@joseurena7116]

I love the fact that you’re doing CTF stuff, every influencer is doing mostly box pwning and ctfs develop those quick thought skills required. Nice to see a pro do it 👊🏻

[@durzua07]

Not gonna lie, I was lost on the whole video but I loved it! Insane stuff John!

[@lepsycho3691]

That was fun, I felt the same feeling watching you as I do when I'm not sure if this is the right track or not! Good job!

[@mossdem]

Loving these videos as always John! I'm now beginning to actually understand what it is you're writing so its a lot easier to follow along. Keep up the grind, love to see it!

[@cedricvillani8502]

Call me crazy but the way he’s going through this isn’t a normal happening out in the wild. It’s too obvious and too rehearsed, he never went into anything technical, it was more of a Öh of course”kind of thing. WITH everything nice and tidy and human readable, one natural logical discovery flowing into the next, it’s like watching someone go through a page of pseudocode. Idk 🤷 I just have not seen any actual exploits work so fluidly and without any obfuscation put into the so called errors he was getting.

[@cenkgokce4404]

Really great solution John, probably I will never figure out that challenge.

[@BRYDN_NATHAN]

11:14 confusion it creates entropy thank you 13:51 [✓] moving "toward" a limit, [✓] moving "towards" a limit

[@dancingtiger577]

algorithm, love learning by watching you learn

[@cedricvillani8502]

Like algorithms you do? Ok.. Let P = Bn, the Boolean algebra of subsets of {1,2,...,n} ordered by inclusion. Let 2 be the poset with two elements (it has two elements ˆ0 ≤ ˆ1) ✅ WiTh M3 S0 FAR?? OK Cool 😎 SO….. because we can view Bn as a zero-one vector. Let us compute μ for Bn. μ for 2 is given by μ(0,0) = μ(1,1) = 1 and μ(0,1) = −1. With the lemma, we find that μ(T,S) = (−1)|T−S| i.e. μ(T,S) = (−1)# times T and S differ. I think the only thing Mr. Hammond is learning is how to make a KZbin Video about Hacking, without actually showing any real useable code so it doesn’t get the BAN hammer 🔨 and costing him a ton of money 💰. It is fun fiction though

[@telephonedude]

I've been really enjoying these videos! I'm a game programmer by trade and this is far enough outside my wheelhouse that I'm learning a ton, but close enough that everything is super easy to follow. A lot of stuff has quickly gotten demystified for me over the past few weeks :p Keep it up!

[@cedricvillani8502]

A real one? Actually that’s mean to say these days, so instead one that designs his own game engines and that does the physics and complex logic, like linear algebra and combinatorics maths (M ̈obius functions for breakfast) OR a GUI drag-n-drop Unreal Engine guy?

[@telephonedude]

@@cedricvillani8502 Says the guy with an "introduction to Unity's new visual scripting tool" vid in his playlist? For reak though, whatever it is that's making you feel so negative, I hope it passes soon

[@georgehammond867]

Leaking the last part of flag was hard. New thing !

[@aceldama]

watching a sequential string search is fun, but painful - kinda like mxsturbating with a cheese grater. it's easier finding the string length first, then doing a binary search. still, great job getting there. i rather enjoy your content. :3

[@FrankTranDesign]

This was fun to watch, thanks JH

[@anthonutty]

I think one other thing you could have done is provide an XPath that selected the n-th occurrence of selfDestructCode.

[@viv_2489]

Thanks for great video ... really enjoying python part of solving problems

[@TheH2OWeb]

John ! Thanks again ! Just took a little time to get how you reached the second occurence. It clicked just after asking on your Discord :-)

[@DirkBaumeister]

I think the second part would have been easier if you had changed the search to ends-with starting with a closing curly braces and reversing the string afterwards :) nevertheless great video! :)

[@chriss8825]

Yea good idea exploiting known knowledge of the flag. His method would also not work if the first char of the second part of the flag started with a 'C'. My initial idea was to leak name, so you ignore the staff with the first part of the flag completely on your second blind sql injection. My method would have took longer, but in theory it would work irregardless what the second part of flag contained.

[@patrickdonohue4518]

Appreciate these videos Sir! Thanks!!

[@Skavin1000]

This felt a bit like everything looking like a nail once you have a hammer. owe knew the key ended with } so maybe "ends-with" would have been easier for the second part?

[@cedricvillani8502]

It’s a logical flow, so anyone, even people who don’t program can follow along and even guess at the answer before he types it. Very mentally rewarding, I mean even the error’s were giving pseudocode answers.

[@nothingreallymatters7530]

dude that was awesome

[@andrescappiello1514]

Amazing John!!

[@berndeckenfels]

I am not sure what the { did in the string concatenation, but both expressions should work without it as only the fist flag part starts with it.

[@capability-snob]

Do you usually find on a job you are guessing how the sql or xpath that the developer wrote is structured or do cheat sheets and scripts usually get you all the way there?

[@cedricvillani8502]

HAHA right , I wish when I got errors they gave me the fix and clue to the next step in Pseudocode

[@ЮЗЛЕС]

Good content!

[@s.aravindh6227]

Nice video bro 👍👍

[@praetorprime]

Great content, as always! I seem to learn something new that I should've already known, every time.

[@prateekkuber8444]

Can someone help me understand how exactly the second part worked for the second part of the flag!?!

[@jannikmeissner]

Could be a really stupid question, but what is actually the limiting factor in the speed of trying different characters? Is it Network speed to the box or could it be made faster if you used multi threading to try multiple possible combinations at once?

[@krlst.5977]

That was fun, thx

[@overgrowncarrot1]

@johnhammond, don't know if this will help in the future but there is xcat for kali that can be used. I know you use parrot and Ubuntu and stuff, but xcat is a tool for XPath injection and can be used with blind XPath. I learned about it in eWPT

[@cedricvillani8502]

He knows, it was even in the document he showed in the beginning, but would not have made a very entertaining story. Not to mention it would be to close to something someone could do in the real world and possibly cost him his KZbin channel, and that is a big $$$ deal. I wouldn’t see why he would risk it, he probably wrote this CTF in the first place. John has taken on and beaten ppl in the real world, like at Def-Con.

[@dedkeny]

Almighty ALGO!!!

[@akhileshp3523]

Nice stuff ❤️

[@RikhiRozzay]

Are you doing all of this on a VM, wsl2 or Linux os?

[@AlexElement]

John, what song is the Outro , it sounds like a very cool instrumental? :D

[@LiEnby]

im confused how that 2nd injection even worked lol i kept saying the answer was //selfDestructCode[1].StartsWith or whatever

[@elizabethsheriff5075]

Hay, how can someone contact you for a CTF teaching

[@arivanhouten6343]

The outro is just build different

[@kennymd]

I feel like John is gonna be so hyped about Python 3.10's new match-case statement

[@nothingnothing1799]

@panda doesn't need END

[@kennymd]

@panda It's basically switch-case on steroids

[@rasooledwards3129]

Can you do a video of you explaining your videos. The methods you're using and your mindset when you're faced with the challenge.

[@ko-Daegu]

You are kidding right ?

[@rasoolnjesus]

@@ko-Daegu no, you must not get the question.

[@cedricvillani8502]

You mean explains how to not only code the problem (ex. CTF) but also do a human readable “hack”that won’t actually work in the real world? Because yes I’m also curious, and I wonder if he employs a few other programmers to make sure he doesn’t step to far outa line and cost him a lot of money

[@HoaPham-rg8rm]

What is problem with python 2 ?

[@shirshak3699]

I hope HTB discord would be better than THM in terms of helping people who dont know how to solve something and also the mods😅

[@SecurityTalent]

Great

[@anirvinyasharma6455]

what Linux distro is Mr. John using ??

[@nothingnothing1799]

Ubuntu i think

[@ЮЗЛЕС]

@@nothingnothing1799 +

[@thedoctor2880]

@@nothingnothing1799 What DE tho?

[@_AN203]

5INALLY !!! Some john hammond things sorry that i haven't watched the stream because of the dummy isp Edit : me see john do some blind things and it works 😐🤨😬🤯🤯🤯😵

[@GunniBusch1]

Can you make Hardware hacking?

[@abhayakarte5207]

Nice

[@Lexxrt]

Hello, Computer? - John Hammond 2021

[@raspberrypi4970]

Or Star Trek IV when Scotty grabbed the computer mouse and tried to talk to it saying, "Hello Computer ." 🤣🤣

[@chetanpatil2473]

please start with basic to advanced daily 1 ctf basic to advanced 🙏

[@qualtersty]

22:20 I'm no hacker lol but I'm pretty sure you could've reversed the original script to check using XPath ends-with instead of using starts-with.

[@nothingreallymatters7530]

more x path injection

[@viniciusdaltro5220]

hello yt algorithm

[@abdulrahmanfaisal288]

Hello

[@bhagyalakshmi1053]

Burp suite 4woinders one 🕐 nod pasbul

[@wolfgtweb]

I have watched a lot of you videos and enjoy them. I guess I finally have to ask. Why is your face on the screen? It doesn't benefit the viewer at all. In fact all it does is get in the way. Is it an ego thing?

[@cedricvillani8502]

It’s a BRAND thing.