Pickle Insecure Deserialization | baby website rick @ HackTheBox

Walkthrough for the "baby website rick" web challenge from ‪@HackTheBox‬.
Learn and understand how serialization and deserialization works and how to exploit Insecure Deserialization vulnerabilities when using the unsafe python module "pickle".
=== Timestamp ===
00:00 Intro
01:03 Serialization and Deserialization explained
01:32 Challenge overview
02:13 Documenting about the pickle module
03:01 Disassembling pickled data using a python script with pickletools
03:20 Searching for pickle deserialization vulnerabilities
04:11 Testing the vulnerability but failing because objects are too differents
04:42 Found a way to genetare the same pickle object expected by the server
05:18 Testing the vulnerability again with success
05:39 Fixing the script in order to retrieve cmd outputs, but failing because python2 != python 3
06:15 Generating the payload using python2 and obtaining the flag
06:46 Outro
If you enjoyed the video leave a like and subscribe to my channel!
For writeups in text format or other articles related to Ethical Hacking go to my blog: maoutis.github.io/
---
Would you like to support my work? Offer me a virtual coffee :)
www.buymeacoffee.com/0xbro
Check out my socials:
Twitter: / 0xbro1
Linkedin: / mattia-0xbro-brollo-b4...

[@ivanzhao4068]

Hi Oxbro, thanks so much for the detailed walkthrough with your whole process. Your chanel is a gem that is underrated. I wish more people can see your channel. Liked and subscribed. Keep up the good work bro.

[@0xbro]

Hello mate! Thank you so much for the kind words and for the sub, they really make me happy! Thanks to you for being here :)

[@rwrbrt7267]

Thank you for all the effort, editing and explanation in this video. Great stuff!

[@0xbro]

Appreciate it bro! Thanks a lot!

[@nicolaspanu7448]

@Oxbro thank you very much, excellent video, finally I really understood what insecure deserialization is. By the way are you Italian? Regards

[@0xbro]

Grazie! Glad the video was helpful :) E sì, sono italiano ahah

[@llllIIIlllllIlIIIllllIlIlIIIll]

Bro sei uno dei pochi in italia che porta questi argomenti, parla in italiano ❤️❤️❤️❤️❤️❤️❤️❤️❤️❤️❤️❤️❤️❤️❤️❤️❤️❤️❤️❤️❤️❤️❤️❤️❤️❤️❤️❤️❤️❤️❤️❤️❤️❤️❤️❤️❤️❤️❤️❤️❤️❤️❤️❤️❤️❤️❤️❤️❤️

[@0xbro]

Ti ringrazio davvero tanto! Purtoppo la lingua italiana però non rende bene in questo settore, perciò sarebbe contro producente per la crescita del canale :( Nei prossimi video però caricherò anche i sottotitoli in italiano, in modo che siano leggibili e comprensibili a tutti :)