PHP include and bypass SSRF protection with two DNS A records - 33c3ctf list0r (web 400)

Поділитися
Вставка
  • Опубліковано 4 лют 2025

КОМЕНТАРІ • 34

  • @TheVamp
    @TheVamp 8 років тому +34

    We also found the intended way, how to get the admin entries. You only must copy a list entry and set the ID to some low values.

    • @LiveOverflow
      @LiveOverflow  8 років тому +16

      Oh! thx :D
      ^ this is the person that did more work on the challenge than me. Should have talked to him first :P

    • @kalaxlimas
      @kalaxlimas 8 років тому +2

      Yup....i got that too ;)

  • @Demonslay335
    @Demonslay335 6 років тому +2

    I love how this challenge was basically broken like 3 times over. Just shows how hard security is. XD

  • @nios1515
    @nios1515 8 років тому +2

    Wonderful Bro keep up good work (y)

  • @ewan91
    @ewan91 8 років тому +4

    Haha 7:44 :D another great video :)

  • @CalumBoal
    @CalumBoal 6 років тому

    Awesome format, subbed.

  • @aidan3994
    @aidan3994 8 років тому +12

    Loving the CTFs, provides us with real world examples of exploits. However, I'm still having trouble learning to apply the knowledge and theory I've learned. I know all about various protocols, common problems with them, knowledge on various exploits, etc. I'm just having trouble looking at places to apply the thing's I've learned. Is there any help you could give me?

    • @LiveOverflow
      @LiveOverflow  8 років тому +8

      you mean for the realworld? If you don't have a work in that field, pick a research topic that interests you. By that I just mean pick for example a web framework and apply your knowledge to it, to understand it as deep as possible and potentially find security issues.

  • @intellectualize6354
    @intellectualize6354 7 років тому

    Exploiting unintended bugs for the win!

  • @OmarTriguiTn
    @OmarTriguiTn 8 років тому +1

    This guy is awesome X)

  • @damejelyas
    @damejelyas 6 років тому

    Whys would someone dislike this

  • @keeper2828
    @keeper2828 6 років тому

    Good stuff.

  • @far2ez539
    @far2ez539 6 років тому +1

    Was it possible to just bypass the 127.0.0.1/8 check by typing the IP differently? E.g., in binary or integer format or in IPv6?

    • @eeleggs
      @eeleggs 5 років тому

      i had the same thing in mind. At 3:42, the function `filter_val` is called. It is a php-function. You can look up those arguments by googling "php filter filters validate". But don't know man. php is shitty. :D

  • @cybrsec
    @cybrsec Рік тому

    I'm starting learning web security from today, but i see Twitter post then get demotivated. am i too late?

  • @Hans5958
    @Hans5958 6 років тому +1

    sponsored by hover

  • @SourceCodeDeleted
    @SourceCodeDeleted 8 років тому

    I would like to participate in more CTFs . Is there a place where I can do this? List0r seems like there are more official teams and events that get announced. I am looking for something more constant and less official. I just work a lot and don't want my work to disrupt my team .

    • @kalaxlimas
      @kalaxlimas 8 років тому +1

      Try shellterlabs.com and pwnerrank.com

    • @SourceCodeDeleted
      @SourceCodeDeleted 8 років тому +1

      kalaxlimas thanks ! I will check it out ))

  • @kennyken7604
    @kennyken7604 6 років тому

    im at a loss, proxy for what?

  • @Xeratec
    @Xeratec 8 років тому +7

    Would it also work if you use 127.0.1.1 instead of 127.0.0.1? because the code checks only for 127.0.0.1/24 but the IPv4 loopback addresss is 127.0.0.1/8, isn't it?

    • @LiveOverflow
      @LiveOverflow  8 років тому +4

      The syntax here is a bit misleading. If you read the function that uses it to check the URL, it actually uses the /24 in a different way. Basically it checks the last 24 bits of the IP, the front must be the same. So 127.0.0.0-127.255.255.255 is blocked.

    • @Xeratec
      @Xeratec 8 років тому

      Oh, okay, thanks for the explanation

    • @rogervanbommel1086
      @rogervanbommel1086 5 років тому +1

      What about IPv6 loopback

  • @yq8dev679
    @yq8dev679 8 років тому

    Hey, ich wollte mal fragen ob du bereit wärst eine fasm/masm tutorial reihe zu starten? @LiveOverflow

    • @LiveOverflow
      @LiveOverflow  8 років тому +1

      Ich denke irgendwann sollte ich mal ein paar videos über assembler machen. Aber leider hab ich so ziemlich null Ahnung von Windows :S

    • @yq8dev679
      @yq8dev679 8 років тому

      Wäre interessant. Mir persönlich wären windows basierte tutorials am liebsten da ich auf windows reverse und programmiere aber linux geht auch, geht ja ums verständnis :) Welche assembler beherrscht du?

    • @LiveOverflow
      @LiveOverflow  8 років тому

      Beherrschen tu ich absolut keinen assembler :D But whatever uses intel syntax I should be comfortable with.

  • @kalaxlimas
    @kalaxlimas 8 років тому +5

    You could also trick parse_url w/ an url like "some:thing@127.0.0.1:80@33c3ctf.ccc.ac/reeeaally/reallyy/c00l/and_aw3sme_flag" in case you don't want the work of messing w/ dns XD

  • @emre9916
    @emre9916 4 роки тому +1

    Please disable automatic video title translation. Technical stuff lose their meaning when translated :)