PHP include and bypass SSRF protection with two DNS A records - 33c3ctf list0r (web 400)

Easy solution of list0r web challenge from the 33c3ctf thanks to unintended bugs in the challenge.
Join the discussion: / php_include_and_bypass...
=[ ❤️ Support ]=
→ per Video: / liveoverflow
→ per Month: / @liveoverflow
=[ 🐕 Social ]=
→ Twitter: / liveoverflow
→ Website: liveoverflow.com/
→ Subreddit: / liveoverflow
→ Facebook: / liveoverflow
#CTF #WebSecurity

[@TheVamp]

We also found the intended way, how to get the admin entries. You only must copy a list entry and set the ID to some low values.

[@LiveOverflow]

Oh! thx :D ^ this is the person that did more work on the challenge than me. Should have talked to him first :P

[@kalaxlimas]

Yup....i got that too ;)

[@Demonslay335]

I love how this challenge was basically broken like 3 times over. Just shows how hard security is. XD

[@CalumBoal]

Awesome format, subbed.

[@aidan3994]

Loving the CTFs, provides us with real world examples of exploits. However, I'm still having trouble learning to apply the knowledge and theory I've learned. I know all about various protocols, common problems with them, knowledge on various exploits, etc. I'm just having trouble looking at places to apply the thing's I've learned. Is there any help you could give me?

[@LiveOverflow]

you mean for the realworld? If you don't have a work in that field, pick a research topic that interests you. By that I just mean pick for example a web framework and apply your knowledge to it, to understand it as deep as possible and potentially find security issues.

[@nios1515]

Wonderful Bro keep up good work (y)

[@ewan91]

Haha 7:44 :D another great video :)

[@benfolland8977]

4:03

[@OmarTriguiTn]

This guy is awesome X)

[@intellectualize6354]

Exploiting unintended bugs for the win!

[@keeper2828]

Good stuff.

[@damejelyas]

Whys would someone dislike this

[@cybrsec]

I'm starting learning web security from today, but i see Twitter post then get demotivated. am i too late?

[@kalaxlimas]

You could also trick parse_url w/ an url like "some:thing@127.0.0.1:[e-mail]/reeeaally/reallyy/c00l/and_aw3sme_flag" in case you don't want the work of messing w/ dns XD

[@LiveOverflow]

sweet! thanks for that

[@Xeratec]

Would it also work if you use 127.0.1.1 instead of 127.0.0.1? because the code checks only for 127.0.0.1/24 but the IPv4 loopback addresss is 127.0.0.1/8, isn't it?

[@LiveOverflow]

The syntax here is a bit misleading. If you read the function that uses it to check the URL, it actually uses the /24 in a different way. Basically it checks the last 24 bits of the IP, the front must be the same. So 127.0.0.0-127.255.255.255 is blocked.

[@Xeratec]

Oh, okay, thanks for the explanation

[@rogervanbommel1086]

What about IPv6 loopback

[@far2ez539]

Was it possible to just bypass the 127.0.0.1/8 check by typing the IP differently? E.g., in binary or integer format or in IPv6?

[@ellcs4506]

i had the same thing in mind. At 3:42, the function `filter_val` is called. It is a php-function. You can look up those arguments by googling "php filter filters validate". But don't know man. php is shitty. :D

[@kennyken7604]

im at a loss, proxy for what?

[@Hans5958]

sponsored by hover

[@LiveOverflow]

No ?

[@emre9916]

Please disable automatic video title translation. Technical stuff lose their meaning when translated :)

[@yq8dev679]

Hey, ich wollte mal fragen ob du bereit wärst eine fasm/masm tutorial reihe zu starten? @LiveOverflow

[@LiveOverflow]

Ich denke irgendwann sollte ich mal ein paar videos über assembler machen. Aber leider hab ich so ziemlich null Ahnung von Windows :S

[@yq8dev679]

Wäre interessant. Mir persönlich wären windows basierte tutorials am liebsten da ich auf windows reverse und programmiere aber linux geht auch, geht ja ums verständnis :) Welche assembler beherrscht du?

[@LiveOverflow]

Beherrschen tu ich absolut keinen assembler :D But whatever uses intel syntax I should be comfortable with.

[@SourceCodeDeleted]

I would like to participate in more CTFs . Is there a place where I can do this? List0r seems like there are more official teams and events that get announced. I am looking for something more constant and less official. I just work a lot and don't want my work to disrupt my team .

[@kalaxlimas]

Try shellterlabs.com and pwnerrank.com

[@SourceCodeDeleted]

kalaxlimas thanks ! I will check it out ))