8:12 it's parts like this, that discourages me from ever being good at CTF's and Hacking overall. How is one supposed to know that you need to use '$' in order to passthrough as text. You really do get better at these things by constantly practicing over time but man the imposter syndrome kicks in 10x when you get stuck because of a simple character you didn't include. I understand GOOGLE is my friend but I wouldn't have even known what to ask it in this situation. . Like Offensive Security says, I guess I need to "Try Harder". Thank you so much for these videos ippsec. You truly keep me motivated.
I should of showed it -- If you grab a .tex file from the "tempfiles" when its being generated, it becomes a bit more obvious. If you have trouble downloading the file, try using ffuf to create a bunch of files, it will slow the server down and won't delete it as fast.
As usual, great video with great information! Not sure why but using BURP I could not get the shell using the POST request, it did work fine on the GET (I am using Kali but I would not think that matters).
I still cannot comprehend why we need the $ before and after the initial payload to leak files. Can someone please elaborate further maybe with examples?
I should of showed it -- If you grab a .tex file from the "tempfiles" when its being generated, it becomes a bit more obvious. If you have trouble downloading the file, try using ffuf to create a bunch of files, it will slow the server down and won't delete it as fast.
There used to be a great TeX book called “The Joy of TeX” (kinda hinting on a different book with similar name) and they pronounced is as “Teks” back then 😅
8:12 it's parts like this, that discourages me from ever being good at CTF's and Hacking overall. How is one supposed to know that you need to use '$' in order to passthrough as text. You really do get better at these things by constantly practicing over time but man the imposter syndrome kicks in 10x when you get stuck because of a simple character you didn't include. I understand GOOGLE is my friend but I wouldn't have even known what to ask it in this situation. . Like Offensive Security says, I guess I need to "Try Harder".
Thank you so much for these videos ippsec. You truly keep me motivated.
@@hbhorat1 It's just experience, Now you know about it. I didn't know about it too. Doesn't matter as long as we learn something new.
I should of showed it -- If you grab a .tex file from the "tempfiles" when its being generated, it becomes a bit more obvious. If you have trouble downloading the file, try using ffuf to create a bunch of files, it will slow the server down and won't delete it as fast.
Although not clear, HackTricks does say "you might need to adjust injection with wrappers as [ or $".
That was such a good video, I had to comment to say thank you for such an extensive approach!
Yeah I solved using the catcode trick to replace backslash with something and was able to write php webshell. Didn’t realize it was unintended
i learn lot's of things from you you help me in lot's of things
Oh, this one kicked my butt
As usual, great video with great information! Not sure why but using BURP I could not get the shell using the POST request, it did work fine on the GET (I am using Kali but I would not think that matters).
great video
Out of curiosity, when running nmap, why do you use -sC -sV and not just -A ?
-A performs one additional task which is OS Detection & takes a little bit more time to complete.
You can't spell Mississippi without Ipp
Push!
The Great
I still cannot comprehend why we need the $ before and after the initial payload to leak files. Can someone please elaborate further maybe with examples?
I should of showed it -- If you grab a .tex file from the "tempfiles" when its being generated, it becomes a bit more obvious. If you have trouble downloading the file, try using ffuf to create a bunch of files, it will slow the server down and won't delete it as fast.
There used to be a great TeX book called “The Joy of TeX” (kinda hinting on a different book with similar name) and they pronounced is as “Teks” back then 😅
why don't you use kali for just one video
Cause he works at HTB and parrot and HTB has some kind of partnership with parrot i guess. But hey, Parrot is great, have been using it since 2 yrs!
No
lol
@@speedfastman