XSS to RCE? CrossFit by Hack The Box

Поделиться
HTML-код
  • Опубликовано: 3 фев 2025

Комментарии •

  • @erickjoshuamaico4233
    @erickjoshuamaico4233 3 года назад +7

    You are so good dude, it is so easy to understand even for someone new in this industry like me

    • @intigriti
      @intigriti  3 года назад +2

      Thank you! That's always nice to hear! Good luck in this incredible industry!

  • @tonyitalia7798
    @tonyitalia7798 3 года назад +6

    Awesome work man.
    I'm Brazilian and even so it was super easy to understand your explanation. Thank you very much man.

  • @milapmerja5033
    @milapmerja5033 3 года назад +2

    Wow man! So simple to understand yet so informative. Awesome work man. Keep it up.

    • @intigriti
      @intigriti  3 года назад

      Glad you liked it! Way more videos to come! 😀

  • @saputello13
    @saputello13 3 года назад +1

    Very nice! Very easy to understand. Thanks!

    • @intigriti
      @intigriti  3 года назад

      Glad it was helpful!

  • @anthonyholderbaum6956
    @anthonyholderbaum6956 3 года назад +1

    Awesome, mindblowing, thank you ! keep it up !

  • @mukeshsingh7069
    @mukeshsingh7069 Год назад +1

    Exceptional content, learned a lot, thank you so much. You are amazing bro 👏
    Two things I am confused with the POST request at 17:36
    1. Why & How did the Token worked? Normally it should get expired once it gets used, right?
    Also, if this is the case, then how can I dynamically get the token from the webpage & use it to submit the account creation request.
    2. You spelled submit incorrectly, still the form got submitted. Why & How?

    • @intigriti
      @intigriti  Год назад

      PinkDraconian is no longer with us but I 100% agree, he's an amazing hacker and created some awesome video content for us 🥰
      I didn't solve this machine but for (1) I would hazard a guess (without watching the full video) that the CSRF token either a) doesn't change (intentionally vulnerable) or b) the token resets on each refresh, but the page isn't refreshed before we use the captured token.
      (2) is probably that a POST request to /accounts container a username and password is all that's required for authentication. The "sumbit" parameter is set to "pinkdraconian" as well, which wouldn't really make sense.

  • @aaryanbhagat4852
    @aaryanbhagat4852 3 года назад

    Its good that draconian is getting a platform!

    • @intigriti
      @intigriti  3 года назад

      We are glad to have pink draconian on the team 😇

  • @S2eedGH
    @S2eedGH 3 года назад +1

    Great explaining I hope you do a lot like this video, Thanks

  • @0xPr3d4T0r
    @0xPr3d4T0r Год назад +1

    man that was really insane

  • @goodboy8833
    @goodboy8833 3 года назад +1

    Super well explained.

    • @intigriti
      @intigriti  3 года назад

      Glad it was helpful! 🔥

  • @dennismunyaka6537
    @dennismunyaka6537 3 года назад

    I've just subscribed looking for more fire content like this in the future

    • @intigriti
      @intigriti  3 года назад

      Thanks for the sub! There is pleeeeenty more to come 😀

  • @mohmino4532
    @mohmino4532 Год назад +1

    good job man im starting love u hhh . but i need to repeat the video many times to understand well because as i said before English is not my native lang😭 but thank u so much 😍

    • @intigriti
      @intigriti  Год назад +1

      Hey, no problem! That's how you learn.. even when videos are in my native language, I often have to repeat many times to understand 😂

    • @mohmino4532
      @mohmino4532 Год назад +1

      @@intigriti thanks i got ur point hhh 😂

  • @iqyou-gw4kd
    @iqyou-gw4kd 2 года назад +1

    Awesome work man.

  • @KuliBangunan86
    @KuliBangunan86 Год назад +1

    amazing and simply one

  • @ashishchauhan9745
    @ashishchauhan9745 7 месяцев назад

    Awesome work

    • @intigriti
      @intigriti  7 месяцев назад +1

      Thanks a lot 😊

  • @presequel
    @presequel Год назад

    wow, great video :)

  • @noony31122009
    @noony31122009 Год назад +1

    Awesome

  • @fm0x1
    @fm0x1 Год назад

    Amazing Video !!!

  • @keanozaralho5490
    @keanozaralho5490 2 года назад

    I got a 200 response when send the payload, but i didn't received nothing in the server side. Can u help me with this ? I've tried it a lot of ways, with Python server, ngrok, webhookers, netcat, using other ports,etc.. But i never receive the resquest in the server side.

    • @intigriti
      @intigriti  2 года назад +1

      Is everything else set up correctly? Could you maybe make a video or blog to show?

  • @burekhacks
    @burekhacks 2 года назад

    Not sure why but the second payload is not returning anything except a 200 response.. the first one worked just fine

    • @intigriti
      @intigriti  2 года назад

      Weird, did you end up figuring it out?

    • @burekhacks
      @burekhacks 2 года назад

      @@intigriti I did indeed! It was a mistake on my end. Thank you for the reply

  • @nhlcreation4240
    @nhlcreation4240 3 года назад

    Awesome, very informative

    • @intigriti
      @intigriti  3 года назад

      Thank you very much! We are happy if you like it 😎

  • @j233wfyw
    @j233wfyw 2 года назад

    Awesome! 😉

  • @felizmelvin5329
    @felizmelvin5329 Год назад

    I love the content.

  • @Borma425
    @Borma425 3 года назад

    thanks

  • @mujta3as3c
    @mujta3as3c 2 года назад

    Reflected xss to RCE ?

    • @intigriti
      @intigriti  2 года назад

      That won't be possible, afaik9

  • @atulsharma4501
    @atulsharma4501 3 года назад

    16:00 CSRF token are not stored as cookies!

    • @intigriti
      @intigriti  3 года назад

      Thanks for pointing out this mistake! My bad!

  • @markcuello5
    @markcuello5 2 года назад

    SECURITY