Hacking Websites by Uploading files (With symlinks)

In this video, I show you how symlinks can be used to read arbitrary files on a web server.
DISCLAIMER: This video is intended only for educational purposes.
The experiments in this video are performed in a controlled
lab setup and not on a live target. The content is purely
from a penetration testing perspective. I do not
condone or encourage any illegal activities.
The web application in the video supports a file upload functionality where users can upload zip files. When we create a zip file that has a symlink in it which is pointing to an arbitrary file on the server, we are able to read the file pointed by the symlink. In this way we can read any file on the server which can be read by the web server user account (www-data). This can be used to read sensitive files like private keys, bash history, and even apache configuration files. We can leverage this vulnerability to read environment variables that the website is using and find interesting information like Database credentials, tokens, secret strings which we can further use to gain access to various services like ftp, ssh, database, etc.
These kinds of vulnerabilities with symlinks have been exploited many times in the wild. One of the finest example is this GitLab vulnerability where the researcher received a $29,000 bug bounty: hackerone.com/...
Thanks for watching!
SUBSCRIBE for more videos!
Join my Discord: / discord
Follow me on Instagram: / teja.techraj
Website: techraj156.com​​​​​
Blog: blog.techraj15...

[@SteveBClark]

The GOAT is back....❤

[@ReligionAndMaterialismDebunked]

:3 I wonder if this can be used on my bug bounty targets. Also, I'm wondering how many Iranian, Lebanon, Saudi Arabian, North Korea, China, and other sites of terrorist, and dictatorship nations I get can into. 😅🥰🤑😋🤤 Great Indian hacker video. English. :3 😅 Shalom. Namaste.

[@raoulduke8064]

yeees new video! GOAT is back

[@_SebJ1000]

It's intresting to learn that they place the password in an environment variable, wonder if most devs encrypt it as well. As that might be the slightest bit more secure.

[@divyam847]

glad that you're back :)

[@anudeepkalyadapu1657]

What a video ! Looking forward for such videos man! Keep it up

[@TejaRavipudi]

big fan. happy that you are back.

[@TheAKAnonymous]

a suggestion, maybe you should try different titles something special surprising to be able to get more views adding curiosity to new students i mean we are technical student we understand your titles but new students might not and last thing as always this was a awesome video your's TheAKAnonymous

[@dishusharma7881]

Where did you learn to pronounce environment as enveeronment? I am curious.

[@manishneupane6070]

Wow, great video. Thank you for making

[@jesusdacoast872]

Very informative, thanks.

[@HackingBinaries-dt2fh]

Love you man, just subscribed

[@mindlesstelevision3213]

Good to see you Back ❤️♥️

[@user-eh5zv6xl1t]

Good content Man.

[@rajeevpuri8319]

thank you Sir , for this easy to understandable video for a noob like me.🙏🙏

[@schooldropout1337]

Is finding a way to upload files without following the usual restrictions considered a security problem? Yes, bypassing file upload restrictions is a security vulnerability because it can potentially allow malicious files to be uploaded to a system, which can lead to various security risks and issues.

[@x_ankur]

How to do that

[@schooldropout1337]

@@x_ankur bro raj will provide an exclusive demo for that scenario 🤠

[@ReligionAndMaterialismDebunked]

Thanks for the donation, and question, brother! 🤝🤑☺️

[@ReligionAndMaterialismDebunked]

:3 I wonder if this can be used on my bug bounty targets. Also, I'm wondering how many Iranian, Lebanon, Saudi Arabian, North Korea, China, and other sites of terrorist, and dictatorship nations I get can into. 😅🥰🤑😋🤤 Great Indian hacker video. English. :3 😅 Shalom. Namaste.

[@st.john_one]

pretty informative and cool, thanks

[@Nin_Cada]

So what is the counter of it? How to not let the hackers get access to the filesystem using symlincks?

[@ClashWithHuzefa]

Check whether if it is a symlink file or not, and don't let the Web server read, access directories, or file outside the Web root. If you are using php, there is a function is_link() to check whether its a symbolic link file or not

[@Nin_Cada]

@@ClashWithHuzefa i see.. So, couple of rules for the webserver should do the trick. Thanks ✨

[@ClashWithHuzefa]

@AkeaNine welcome buddy

[@scorpionisready]

Informative ❤️

[@prudhvikonakalla9605]

Raj-"kingu kingu"

[@lnstagrarm]

More unique python projects please

[@SankalpaBaral1337]

Brother do you remember you used to create challenges (like CTF)? Please make those types of videos again.

[@monsterzero6928]

Can you please make a video on burpsuite how to inject files on servers by changing the file extension and injecting a backdoor with that

[@pinged69]

Does this affect sites that do not do anything with the file, just purely serve it? I have a pretty basic file hosting service thats public, do I need to somehow worry about this? Symlinks are not something that can be POSTed over HTTPS, right?

[@TechnicalHeavenSM]

😍😍😍.. You are back❤❤

[@SwineTech]

Daemon, a program that runs in the background, anyone noticed the daemon

[@montala3380]

Hi brother, the symlink is only work when target site use ZIP/ TAR. How about normal upload file? can I upload that symlink file to retrieve the content?

[@gowthamreddysomala]

Anna nee Videos Kosam Wait Chastunnam ..

[@x_ankur]

THAT WAS CRAZYYYYYY BRUHHHHH 🔥🔥🔥🔥🔥❤❤❤❤

[@sagarhp2350]

He's back.. 🤩

[@anuzravat]

is there some related article for this symlink vuln, u would like to recommend

[@Si6n9ne]

where to get this source file of the one you doing right now,

[@Si6n9ne]

Is there any way to recreate this vulnerability, I wanna try and test it out If yes someone point me to it please

[@rishi8413]

love the explaination

[@nemizy]

you went to traversal attack method lol

[@Topfive_realestate]

Love you bro 💪💪

[@jimmlmao]

thats actually genius

[@evilspidy6924]

Is this exploit have any number like cve-#####

[@TheAKAnonymous]

so late to watch your video

[@usningame5177]

Do you provide. Course

[@Faysalauchan]

😮😮 so amazing

[@shahzansid]

❤

[@mahesharyatech]

Any Issues With Users ?

[@ClashWithHuzefa]

Amazing

[@ReligionAndMaterialismDebunked]

:3 I wonder if this can be used on my bug bounty targets. Also, I'm wondering how many Iranian, Lebanon, Saudi Arabian, North Korea, China, and other sites of terrorist, and dictatorship nations I get can into. 😅🥰🤑😋🤤 Great Indian hacker video. English. :3 😅 Shalom. Namaste.

[@khushipardeshi3114]

Hua kisi se actually hack??

[@JohnDoe-xp9rd]

Cool

[@vicmacarra]

Lel, interesting

[@IDK_911]

just upload webshell

[@sbh3612]

❤

[@localh0ste]

❤

[@PlayerOne69]

❤

[@pavansasank]

❤