Laravel CVE / PHP Deserialization - "Larablog" HTB Business CTF

If you would like to support the channel and I, check out Kite! Kite is a coding assistant that helps you code faster, on any IDE offer smart completions and documentation. www.kite.com/get-kite/?... (disclaimer, affiliate link)
For more content, subscribe on Twitch! / johnhammond010
If you would like to support me, please like, comment & subscribe, and check me out on Patreon: / johnhammond010
PayPal: paypal.me/johnhammond010
E-mail: [e-mail]
Discord: johnhammond.org/discord
Twitter: / _johnhammond
GitHub: github.com/JohnHammond

[@Operaatoors]

I’ve always been no trailing slash guy, but now I am thinking going to be always tailing slash guy

[@flaxeneel2905]

wow that was fun to watch, i honestly didn't know about that nginx misconfig. uhhh time to go recheck all of my configs coz thats pretty scary

[@helmchen1239]

that's exactly what i did while listening to the rest of the video, even though i was pretty sure i didn't use aliases - better safe then sorry right :D

[@masterjiggle5728]

Damn man... Its so awesome to watch you do this.. Keep it up

[@MattMcT]

John… lovely work as always dude! Cheers! [checks path mods]

[@amraljaifi8792]

Thank you so much 🥰🥰🥰

[@Nature08405]

Thanks so much Amazing content ^^

[@DcWHaT07]

Wow John your amazing!! Thank you for all the amazing how-tos! I’m curious how long did this take you to do? Your real time, keep it up. God bless.

[@SumanRoy.official]

Hi John, just need some knowledge that I am trying to figuring out recently, currently I am fiddling around with Java, and interesting thing I found about it was that Windows 10 does not check for Code Sigining of a Jar file but if I deploy a simple hello world written in C/C++, exe file on a different computer it detects it as a malacious file and does not let user to run it. What are the edge cases that will prevent someone from writting a Java based virus or a ransomware to go undetected by a security endpoint given the fact writing obfuscate code to prevent behavioural analysis by security.

[@Car777777777]

great wholesom video

[@justgiz]

I had no idea what was going on until the last few moments. No idea what Capture the Flag had to do with Laravel. But you're actually playing Capture the Flag. Interesting.

[@SinusQuell_]

nice one

[@MrRobotUy]

👏🏻👏🏻👏🏻 Awesome!

[@JNET_Reloaded]

Interesting, any other / exploits we should know about to path our systems?

[@estebmun9462]

Amazingg videoo !!

[@vivekchoudhary8745]

FYI, Azure VMs are not "pingable", Microsoft for some reason removed this feature from Azure VMs

[@MartinKrisell]

A small clarification - the .env file is gitignored because different environments uses different .env values, and to keep this away from source control, but not because we want to exclude/hide it from a production environment. Of course, there are also other ways to set environment variables in a production runtime.

[@quangvo4563]

Hey John. I wonder if i can solve these challenges after the ctf is over ?. I want to practice on my own

[@cesaredwuardsperezrobles5458]

That was hot

[@ca7986]

❤️

[@phoenixzeu]

Hey John, can you do Etituber? I'm curious about the XXE payload...

[@tylersmith8245]

Laravel 😍😍😍

[@MatteoGariglio]

I am not super familiar with command line: what does "cat /tmp/f | sh -1 2>&1" actually do? Thanks John, your videos are really awesome!

[@HMUP7]

the output of /tmp/f is being piped to or run by sh

[@somebodystealsmyname]

It's trick with named pipes (mkfifo). With some redirection magic you get an executable to be passed over nc. It's often used for reverse shells because /dev/tcp is a Bash only feature and nc -e is often disabled due to obvious reasons.

[@dareenoch6880]

What's the cookies plugins, John?

[@fachruzi.ramadhan]

He used CookieManager - Cookie Editor

[@jsz4937]

kuuuurwa

[@zeepranabesh911]

Sir, I want to build a booking website using php, html and css. If I don't learn javascript is it possible to make it

[@JanBebendorf]

It's possible without javascript but it will completely suck. If you actually know php already, adapting to other languages should be no big problem. If you can't adapt you probably didn't actually understand the key concepts yet and you should dive into the very basics of DSA first.

[@leosnavratil3821]

What version of Xubuntu does the VM have?

[@sandra8139]

I am posting all the information of identity thefts scammers as I am building myself to be unstoppable success of my own

[@2penry2]

could you access the .env file? *EDIT* lol I was way too impatient.

[@raghavendrans9667]

Can you do a video of Pegasus spyware how it works and how to protect from it

[@Chezt]

That ngix misconfig is scary

[@MikeStratton]

I will no longer sleep at night.

[@comdeyoverflow2414]

Hey John, I notice that you always solve more web challenge in HTB Business CTF. I think that your channel root is reversing or crypto. Can i know the reason?😊

[@_JohnHammond]

I have a challenge from the reversing category and two from the cryptography category recorded and ready -- I have just been uploading Web first 🙂 Granted, I like web stuff 😜

[@comdeyoverflow2414]

@@_JohnHammond I like Web Stuff too.

[@yoshi5113]

I think, Web hacking is a good start for learn hacking 😁

[@JanBebendorf]

What about simply reading /assets../.env? If that doesn't work, because we are speaking of php developers, there is always at least one route that can be easily forced into a 500 to get the debug screen and read the entire configuration from there.

[@alikhatab1009]

When you get access to .env you have access to the db name user + password I think you could just try that for to ssh to the server

[@sihmy9870]

Test CVE-2021-36934 Serious SAM and Hive-Nightmare

[@ichhabahnung]

I'm sry, I found you a few weeks ago, and love the content, but I just have to say it. God: 'how many frackles do you want" John: "yes" XD love you! Keep it up!

[@LasseRafnDk]

Bottomline: deny ANY file/directory starting with a dot from being accessed publicly.

[@jmjl2]

.well-known is the only exception to that rule.

[@mrmarker98]

Pog? Pog? Being early-ish?

[@Infamous159]

I didnt know seth rogan had a twin brother who is a hacker

[@mohdrizwan3676]

Sir please give your picoCTF class code

[@xronnet]

you do not need to close the `?>` in php files

[@varadvithalkj1716]

all it took was a simply missing '/'

[@pirbaba755]

Need firebase exploit

[@shehanchathuranga2430]

Why are you using old version of Ubuntu

[@CoolFire666]

I noticed that too. To be fair, he probably has extended support on it through ubuntu advantage, but it's still worth a small bit snickering just as a matter of course.

[@onejdc]

he also has VM image he uses for CTF/pen that runs perfectly and does what he needs to. No point in updating it....yet