HackTheBox "Business CTF" - Time - Command Injection

If you would like to support the channel and I, check out Kite! Kite is a coding assistant that helps you code faster, on any IDE offer smart completions and documentation. www.kite.com/g... (disclaimer, affiliate link)
For more content, subscribe on Twitch! / johnhammond010
If you would like to support me, please like, comment & subscribe, and check me out on Patreon: / johnhammond010
PayPal: paypal.me/john...
E-mail: [e-mail]
Discord: johnhammond.or...
Twitter: / _johnhammond
GitHub: github.com/Joh...

[@markgentry8675]

Really enjoyed the time you took to explain this one. it's pretty straight forward, but this format would be great for beginners. love your work

[@SinusQuell_]

this makes me want to try some of these myself

[@FVT-tn8ji]

Yeah same, the problem is that Ive never done anything like that lol

[@LlewdLloyd]

Just wanted to say I'm new in the I.T. industry, read A+ and studying for my Network + cert while pursuing cyber security and watching these videos and having you explain things is really helpful for me despite how basic some of these are. Just wanted to say I appreciate the content this way.

[@EmaCannella]

Followed you up since start of the year and quality has evolved in the meantime. Keep It up📼

[@viv_2489]

This little breadcrumbs are so essential, thanks for sharing 👌👍

[@MovieWorldNow]

I like the tune after the video ending

[@ca7986]

I love your work John! ❤️

[@jocularich]

Love your content John....learn more and more.....greeting from indonesia

[@4lpina]

absolutely love your videos John

[@joeymelo2882]

Love the CTF videos! Keep that up man!

[@highvisibilityraincoat]

yay john is going back to his roots

[@vivekchoudhary8745]

I learned a lot from this ctf.

[@safwanljd]

The reason it didn't work in the browser/curl was because you were using && instead of ;
&& runs the second command only if the first command ran successfully
; runs the second command regardless of the first command
And since the first command is `date ''` which returns an error, the second command never ran!

[@_JohnHammond]

?format='; whoami # still fails in the browser.
The command would run `date +''`, which doesn't error, and returns an error code of 0 indicating it succeeded. It just has an empty string for a format string :)

[@AwesomeLazyNinja]

@@_JohnHammond I believe the reason it does not work in browser is because # is never sent to the server as it is the "fragment identifier". However, URL encoding it to %23 might have worked IMO :)
Thank you for great video as always!

[@ashishalex10]

Awesome content, getting to learn some new stuff :)

[@koukiadem]

Can you please tell us why it didn't work with curl or browser? And why it's working only python?

[@andy-og7sv]

brilliant

[@masfreitas]

love your videos man

[@mmmdyarcavadl9004]

Really helpful thank you

[@faizaanilyas]

What happened to the dark web series?

[@thischannelhad40subscriber51]

Great video's mate.

[@ikhmalfahmi9308]

Yayyyyy ctfs!!!!!!

[@kiingjamesdagamer4738]

Love ur vids

[@sudosuraj]

That was good

[@evanhadi6395]

u are awsome

[@comdeyoverflow2414]

I am first command. Holy YES!

[@vaisakhkm783]

Me first to reply you and second to comment 😏

[@nizarel-marzouki9076]

Me second to replay and third comment

[@johny_dope5361]

@@nizarel-marzouki9076 me third to reply and 4th to comment :)

[@deanvangreunen6457]

5th. baby!!!

[@thatsilentguy2483]

You may be first to command but not to comment

[@prowlerL33T]

Htb ca 2024 had same challenge again this year lol

[@jobdekho-t6l]

hey how did u crack the password? that time it was unprotected but now password is required. actually I am new here

[@m4rt_]

to the 8 people who disliked, Why?

[@JitendraKumar-pi4bd]

Sir ... if possible ... please release a video on Pegasus spyware ...

[@chillydickie]

shebang

[@mrkaraly612]

Update your chrome

[@neil7724]

Nice try!

[@wildmatt1205]

2nd comment because replies to comments don’t count.

[@keroskyindonesia6477]

3rd Comment Muahahaaaa

[@deanvangreunen6457]

7th