Request Smuggling & SSRF = Flag? - HTB Proxy - Hack The Box Business CTF

Поделиться
HTML-код
  • Опубликовано: 13 окт 2024

Комментарии • 25

  • @JasonKahlen
    @JasonKahlen 3 месяца назад +1

    Welcome back!! 🎉🎉🎉

  • @xonepsy
    @xonepsy 3 месяца назад +3

    Long time no see , we miss u bro 😢

    • @PinkDraconian
      @PinkDraconian  3 месяца назад +2

      Life's been so busy and so many crazy opportunities have been popping up that I just haven't had time! Hope you're doing great!

    • @xonepsy
      @xonepsy 3 месяца назад +1

      Im fine bro , thanks for asking ,i wish the same for u , hope you are enjoying your life there .. btw i love ur content a lot , thank u for this great vedio 🎉 ​@@PinkDraconian

    • @PinkDraconian
      @PinkDraconian  3 месяца назад

      @@xonepsy Thank you very much! Glad you like it and I hope everything is going great for you too!

    • @xonepsy
      @xonepsy 3 месяца назад

      @@PinkDraconian do you remember me? 😃

  • @doloreshaze811
    @doloreshaze811 Месяц назад +1

    why didn't we put host header in the second request ? If we dont do it, how does it know where to go ?

    • @PinkDraconian
      @PinkDraconian  Месяц назад

      I believe it isn't necessary as basic Express setups don't actually require the host header. It's been a while since I looked into this tho!

    • @doloreshaze811
      @doloreshaze811 Месяц назад

      @@PinkDraconian okay. Got it. Great explanation buddy. 😄 i request you do the same for percetron challenge which was there in cyber apocalypse ctf 2024.

  • @isiraadithya
    @isiraadithya 3 месяца назад +3

    🙌

    • @PinkDraconian
      @PinkDraconian  3 месяца назад +1

      How are you doing Isira?

    • @isiraadithya
      @isiraadithya 3 месяца назад +1

      @@PinkDraconian Hey!
      Thanks for asking, I am doing fine. How about you?
      I got a 3 month vacation from University studies... (until August)
      So, focusing on bug bounties these days... :) I missed a lot of hacking related stuff
      As always great video! :)

    • @PinkDraconian
      @PinkDraconian  3 месяца назад +1

      @@isiraadithya Nice to hear! Hope you get some big bounties soon!

  • @chihoangcao6622
    @chihoangcao6622 3 месяца назад

    "i forger all the time" ...me too mate

    • @PinkDraconian
      @PinkDraconian  3 месяца назад

      I always, always forget the most basic stuff 😂

  • @tylercoatsworth5220
    @tylercoatsworth5220 3 месяца назад

    Very cool

  • @doloreshaze811
    @doloreshaze811 7 часов назад

    removing the HTTP/1.1 in the second req makes the differnce. If you dont remove HTTP/1.1 in the second request then it will not work. Can you please explain why removing it is necessary ?

    • @doloreshaze811
      @doloreshaze811 7 часов назад

      even if you do HTTP/1.0, it will work. But it wont work if you keep HTTP/1.1 . why so @pinkdraconian

    • @PinkDraconian
      @PinkDraconian  6 часов назад

      I believe that is just the way that pipelining requests works in the specific framework used, but I may be wrong there.

  • @yousdouse6354
    @yousdouse6354 3 месяца назад

    can you make video on secure code review.

    • @PinkDraconian
      @PinkDraconian  3 месяца назад

      What exactly would you like to see? Doing some research on open source libraries?

  • @dirsigler
    @dirsigler 3 месяца назад

    Why is the Golang code written so weird? Who the fuck writes "server-status" as bytes instead of just using the literal string?

    • @PinkDraconian
      @PinkDraconian  3 месяца назад

      Security through obscurity? 🤔 I guess it makes it more "challenging"? (It really doesn't)