Hey! Lovely video as always. Just wanted to say, the part where the hash of the password has to end in "001" in order to be valid and you've found one to be "abkr". You overworked the code a bit... For example you could have just made a single for loop going from a number 0 to 10000000, every number to string and just hash that, much easier and way less code to loop through numbers than ascii characters. The one i've found is 5265 with its hash being 'f127a3f714240273e254d740ed23f001'.
Fun fact: Because cryptographic hashes map evenly from all possible inputs to all possible outputs, it doesn't really matter what you're hashing. You could start at the number zero, take the hash from that and keep incrementing it by 1 until you hit your target hash. (or you could hash a random string/number every time) Because every hash outcome has the same probability to occur, (and all hashes ending in "001" also have the same probability) you will find your target hash just as quickly. Note: I converted the number to string here due to readability of the code. More straightforward computationally would be to simply hash bytes and increment those bytes until you hit your target. import hashlib i = 0 while True: m = hashlib.md5(str(i).encode()).hexdigest() if m[-3:] == '001': print(f'the md5sum of `{i}` is `{m}`') break i += 1
I was able to follow pretty easily up to privilege escalation because of previous knowledge, but even the prev esc part was understandable because of your thorough explanations! Also loved to see that you actually took the time to code some brute forces (hash, code, and even directories (even though you didn't write the code yourself)). Sometimes it really does take some dirty, boring, and time-consuming work to get somewhere.
Loving the videos, currently studying for a cyber security degree here in the UK and find your videos are helping me pick up additional skills that are useful for my course. Thank you John
I just started learning with Hack the box and although I understood very little due to my technical knowledge. I enjoyed the video. I will come back to this video in 6 months time to see if my understanding has improved Great content!
from @26:38 to @28:30 you could simply just send any 4 digit MFA code and then in dev console right-click The post request from the network tab and select copy -> Copy as cURL.
John: Some ideas for you: I don't know every video you have on here but: "This is what an attack looks like on screen on Windows" "This is how the colonial pipeline happened and what I would have done to attempt avoiding it" "The is how pen testers and bug bounty did their job in the Mitnick days before Burp Suite existed" "This is how pen testers did their job before metasploit existed" "This is probably why Russian and Chinese hackers are so good" I'm thinking video like these would separate your account and put it at a new level of you have the time Nice to meet another hacker!!
Very very good, John I have often followed your videos, and I must say that you explain all the steps really well. I really liked the Priesc with the service to restart, with the help of the comnado watch. Really good.
I'm watching it in part for all the cool github links and in part for console wizardry, don't want for it to be a full-time job for me but these things are just so cool to watch.
I'd love to see more live competition stuff like the old king of the hill livestreams, especially the older streams when they didn't know the rooms yet. They don't make new rooms for those enough so it's just autopwn scripts for them all by now with the only competition being fighting for the king file and bricking the box which isn't really as interesting. HTB battlegrounds was interesting but felt too formal, I liked THM KotH streams since they were generally more laidback.
Although I could follow till the end while getting also lost with the playing around python prog stuff it was amazing...great video as always...thanks John
Hey John.. Your video was great.. Had a lot of fun.. I've learned a lot.. Well, not sure how much I have assimilate it.. I still need to practice.. Chuck was right in his videos, you are great.
Nice video John. I've never seen .phps files in the wild before, but probably a good idea to include that extension when doing dirbuster etc. from now on. Privesc was pretty nice!
Another great video. Could you please make a video on Active Directory Resources that can help us to prepare for OSCP (new exam changes)? Thanks a lot 🙂
The goal I get it is take the shortest route but damn leaving all your requests commands and logins logged, gonna be hard to cover up. Best video I’ve ever watched btw, no video has stood out to me so much, your knowledge is amazing!
Thanks for another great video. One question though: Why do you call the python script by invoking `python` when you have a python shebang set? Or asked the other way around: Why do you set a shebang when you don't chmod +x the script and execute directly?
I love wfuzz. It's so super versitile. Directory search, dns name search, fuzzing user agents, cookies, form posts. You can get stuff from files, encode on the fly, get your input from stdin and pipe hashcat or some python script into it
Idk if anyone still answers questions from these older videos or not, but is that IP Address you copied is that the target IP address? Like the system you are attempting to Hack?
Yes, when TryHackMe finishes "start machine" after 60 seconds and gives you an IP address, that is the IP address of the machine (inside the VPN network) that you are targeting :)
I am trying to learn all the ins and outs of ethical hacking, I would like to be able to protect myself, from all of these different avenues that Black Hat Hackers exploit every single day. Yō, I do watch all your videos bro. Love the content thanks. @@_JohnHammond
I have had my Gmail account stolen once before, I use to play games on PlayStation and when I switched to PC no one told me about Hackers, I mean I knew they existed, but I didn't know they were everywhere on Steam. My friends on PSN were just friends, but I found out real fast that you cannot trust anyone on Steam at all. There was a thief that pretended to be a friend, that told me that he reported me for cheating, I was like, "What" because I have never cheated at any video game, but he led me to think that Steam anti-cheat personnel wanted to talk to me about this event and provided me a link to click. I didn't know any different, and they stole my Steam account and from there they broke into my Gmail, disabled 2fa, and almost broke into my PayPal where I have 800 dollars, Luckly Google shut that account down before they did. That has been a few years ago. But if Malware is what you like, Steam is full of it. @@_JohnHammond
The difficulty is not finding a valid md5 hash, but in finding a password that has the hash you want. That's what you get to put in to the site - the password, not the hash.
Fail2ban needs to be setup manually for non-builtin services (e.g., this mfa). The real reason though, it's part of the game. Remember the line "hey Fred we need to setup fail2ban on this mfa"
Couldn't bruteforce be prevented by limiting login attempts like X amount of times lockout for 30 minutes... Why isn't this more common as it was in 2011? This also why I hate 2fa and "type 4 digit code we sent your in your SMS"
That's how I do it on my web site, it starts with 1 second lockdown, then 2 seconds, then 4 and so on, up to I think it's 2^8 seconds. The lock down mechanism doesn't have any power like fail2ban has, other than it requests to put a ban on the IP (which can then be denied by other parts of the program). It's very possible because I have zero knowledge about fail2ban, but I am curious why that function has a power in itself. It looks to me like it should not have. Also, putting too much advanced things into this I think makes it more vulnerable, and I am not trying to take _all_ attacks, just the most obvious ones. I believe in layered security, not one thing fits all. Trying to take all attacks will be pointless, when you can just attack from random IPs and at random rate. And in the end, it's not even about these attacks, it's about how to protect _when_ the attack succeeds. Like, so many people use the same password for different services, and this fail2ban does not protect against that, if another service is hacked and passwords revelaed.
Hey! Lovely video as always. Just wanted to say, the part where the hash of the password has to end in "001" in order to be valid and you've found one to be "abkr". You overworked the code a bit... For example you could have just made a single for loop going from a number 0 to 10000000, every number to string and just hash that, much easier and way less code to loop through numbers than ascii characters. The one i've found is 5265 with its hash being 'f127a3f714240273e254d740ed23f001'.
Fun fact:
Because cryptographic hashes map evenly from all possible inputs to all possible outputs, it doesn't really matter what you're hashing.
You could start at the number zero, take the hash from that and keep incrementing it by 1 until you hit your target hash. (or you could hash a random string/number every time)
Because every hash outcome has the same probability to occur, (and all hashes ending in "001" also have the same probability) you will find your target hash just as quickly.
Note: I converted the number to string here due to readability of the code. More straightforward computationally would be to simply hash bytes and increment those bytes until you hit your target.
import hashlib
i = 0
while True:
m = hashlib.md5(str(i).encode()).hexdigest()
if m[-3:] == '001':
print(f'the md5sum of `{i}` is `{m}`')
break
i += 1
I was able to follow pretty easily up to privilege escalation because of previous knowledge, but even the prev esc part was understandable because of your thorough explanations!
Also loved to see that you actually took the time to code some brute forces (hash, code, and even directories (even though you didn't write the code yourself)). Sometimes it really does take some dirty, boring, and time-consuming work to get somewhere.
Loving the videos, currently studying for a cyber security degree here in the UK and find your videos are helping me pick up additional skills that are useful for my course. Thank you John
😂 He said JSON instead of Jason 😂😂😂
19:31 "Umm, and actually I'm gonna do something stupid", with that voice crack xD I actually lol'd on that :D
How can you not subscribe to this? This is gold.
I just started learning with Hack the box and although I understood very little due to my technical knowledge. I enjoyed the video.
I will come back to this video in 6 months time to see if my understanding has improved
Great content!
I love how you pop the machine's IP into $IP and then never use $IP again. ;-)
Just loved the way you teach all of us is very precious... love you john ....!! and thank you for keeping up the good work.
from @26:38 to @28:30 you could simply just send any 4 digit MFA code and then in dev console right-click The post request from the network tab and select copy -> Copy as cURL.
Crazy never seen such a brilliant person ☺️
I started watching your videos the same way people watch sports, so entertaining and educational! keep it up :D
John:
Some ideas for you:
I don't know every video you have on here but:
"This is what an attack looks like on screen on Windows"
"This is how the colonial pipeline happened and what I would have done to attempt avoiding it"
"The is how pen testers and bug bounty did their job in the Mitnick days before Burp Suite existed"
"This is how pen testers did their job before metasploit existed"
"This is probably why Russian and Chinese hackers are so good"
I'm thinking video like these would separate your account and put it at a new level of you have the time
Nice to meet another hacker!!
Very very good, John I have often followed your videos, and I must say that you explain all the steps really well. I really liked the Priesc with the service to restart, with the help of the comnado watch.
Really good.
Your talent in following numbers are so more this one to you got talent .
I'm watching it in part for all the cool github links and in part for console wizardry, don't want for it to be a full-time job for me but these things are just so cool to watch.
oh you are great， isee these things ， ifeel it so complicated😹
This was a ton of fun. Thanks alot john. am also waiting, idk what am waiting but am waiting! 🤣🤣
i love this video mr ham hands ive missed the tryhackme content!! more pls
I miss crazy stuff like PWNY Island and other big hacking competitions. Do people still host those anymore?
I'd love to see more live competition stuff like the old king of the hill livestreams, especially the older streams when they didn't know the rooms yet. They don't make new rooms for those enough so it's just autopwn scripts for them all by now with the only competition being fighting for the king file and bricking the box which isn't really as interesting. HTB battlegrounds was interesting but felt too formal, I liked THM KotH streams since they were generally more laidback.
Great video, thanks for the intro to feroxbuster, wasn't familiar with that one.
This feels like old school Hammond. Love it.
Dude, this is amaznig. I appreciate you content.
Thanks again John for this video. Best regards from a 'Normie'!
Nice video. Do you do any live boxes like fresh so we can see you stumble around a bit? I like that raw style.
Haven't been here a while but happy to be back! Great video John as per usual
Although I could follow till the end while getting also lost with the playing around python prog stuff it was amazing...great video as always...thanks John
Enjoyed the video as always!
Love watching your context bro👍🏼
That was a really fun challenge to watch and now I'm going to practically try it out.
Hey John.. Your video was great.. Had a lot of fun.. I've learned a lot.. Well, not sure how much I have assimilate it.. I still need to practice.. Chuck was right in his videos, you are great.
That was awesome. Thanks john!
awesome video will definately give that room a go looks fun
Windows 8
Não precisa de ajuda nenhuma
Entende de tudo né?
É segurança da Informação?
Nice video John. I've never seen .phps files in the wild before, but probably a good idea to include that extension when doing dirbuster etc. from now on. Privesc was pretty nice!
Man loved the way you explain everyting first ever video keep up the good work. :-)
Another awesome video John... Really enjoy the content :)
i may be a few months late, but these videos always help me with my stuff, now i know what NOT to do when configuring.
Hey John! Also waiting! ;)
Really loved it. Learned a lot. Thank you so much for making great content. Really appreciate it.
Love from India
I hit the red button. keep up the good content :)
Another great video. Could you please make a video on Active Directory Resources that can help us to prepare for OSCP (new exam changes)? Thanks a lot 🙂
please do check the cyber mentor 's zero to hero playlist
I love how the room has 67 upvotes and john says 75.
The goal I get it is take the shortest route but damn leaving all your requests commands and logins logged, gonna be hard to cover up.
Best video I’ve ever watched btw, no video has stood out to me so much, your knowledge is amazing!
25:11 Ah, of course, my good friend -Jason- JSON
12:50 Very useful tip while hunting on php target.
Subscribed. Wow. Amazing content. Thx.
john why are you rounding up at closest miltiole of 25 im curious 00:40
Real life Uplink.
Waiting dudeee
It is so ironic that fail2ban can be used for privesc. lol
People like you are the reason my accounts keep getting hacked lol
You are a wonderful professor
Thanks for another great video.
One question though: Why do you call the python script by invoking `python` when you have a python shebang set? Or asked the other way around: Why do you set a shebang when you don't chmod +x the script and execute directly?
I loved It a lot! Thank You!
That ending hot me surprised
Why does chmod +s /bin/bash allow for privesc on demand?
For the algorithm, great video sir.
What kind of system are you running? CPU /GPU etc..!
I love wfuzz. It's so super versitile. Directory search, dns name search, fuzzing user agents, cookies, form posts. You can get stuff from files, encode on the fly, get your input from stdin and pipe hashcat or some python script into it
Legend!!
Fail2ban enabled on the mfa would have been interesting
Great video again. I would use ffuf instead of your bash command.
I am soo noob right now and learning. I wonder how long would it take to brute force a 6 digit and a 8 digit code.
Anyone know what shell/interface he's using, been looking for it forever and can't find it. Really helps with the command and history prediction
on my computer the padding with {0000..9999} works in zsh but not in bash, am I the only one?
Will you do a clickjacking video next?
Hey John, in your loop, wouldn't it be better to use ... grep -v "Incorrect code" && echo $i; break ...?
I appreciate you.
how often did ppl ask you if you are related to kermit?
You are Brilliant :)
This was a lot of fun!
Thanx, again great video. And i’m a subscriber 🤣🤣🤣
who in the world would configure the webserver to display phps ? Seems like a very bad idea
Loved it. Watched the whole thing and it is fascinating from start to end.
loved it 🔥🔥
Awesome video!
Ah yes,
It is very easy when you do it, but the opposite is when we do it, it is difficult and it is not solved at all
very good content bhaiya
{
This video is Unmatched.
I’m new to cyber security but I’ve take. Some classes and am looking to get some certifications is there any you recommend?
Ps love the content man
that was pretty cool
Idk if anyone still answers questions from these older videos or not, but is that IP Address you copied is that the target IP address? Like the system you are attempting to Hack?
Yes, when TryHackMe finishes "start machine" after 60 seconds and gives you an IP address, that is the IP address of the machine (inside the VPN network) that you are targeting :)
I am trying to learn all the ins and outs of ethical hacking, I would like to be able to protect myself, from all of these different avenues that Black Hat Hackers exploit every single day. Yō, I do watch all your videos bro. Love the content thanks. @@_JohnHammond
I have had my Gmail account stolen once before, I use to play games on PlayStation and when I switched to PC no one told me about Hackers, I mean I knew they existed, but I didn't know they were everywhere on Steam. My friends on PSN were just friends, but I found out real fast that you cannot trust anyone on Steam at all. There was a thief that pretended to be a friend, that told me that he reported me for cheating, I was like, "What" because I have never cheated at any video game, but he led me to think that Steam anti-cheat personnel wanted to talk to me about this event and provided me a link to click. I didn't know any different, and they stole my Steam account and from there they broke into my Gmail, disabled 2fa, and almost broke into my PayPal where I have 800 dollars, Luckly Google shut that account down before they did. That has been a few years ago. But if Malware is what you like, Steam is full of it. @@_JohnHammond
xxd isn't a builtin, but a part of vim... ;-)
Couldn't you just do a lookup of any arbitrary md5 hash, and change the last 3 to 001...?
The difficulty is not finding a valid md5 hash, but in finding a password that has the hash you want. That's what you get to put in to the site - the password, not the hash.
@@capability-snob TY
nice one buddy
I do not understand why fail2ban did not work when you were bruteforcing mfa.
Fail2ban needs to be setup manually for non-builtin services (e.g., this mfa). The real reason though, it's part of the game. Remember the line "hey Fred we need to setup fail2ban on this mfa"
I'm one of the other 45% \o/
LastPass 👀
Couldn't bruteforce be prevented by limiting login attempts like X amount of times lockout for 30 minutes... Why isn't this more common as it was in 2011? This also why I hate 2fa and "type 4 digit code we sent your in your SMS"
That's how I do it on my web site, it starts with 1 second lockdown, then 2 seconds, then 4 and so on, up to I think it's 2^8 seconds. The lock down mechanism doesn't have any power like fail2ban has, other than it requests to put a ban on the IP (which can then be denied by other parts of the program). It's very possible because I have zero knowledge about fail2ban, but I am curious why that function has a power in itself. It looks to me like it should not have. Also, putting too much advanced things into this I think makes it more vulnerable, and I am not trying to take _all_ attacks, just the most obvious ones. I believe in layered security, not one thing fits all. Trying to take all attacks will be pointless, when you can just attack from random IPs and at random rate. And in the end, it's not even about these attacks, it's about how to protect _when_ the attack succeeds. Like, so many people use the same password for different services, and this fail2ban does not protect against that, if another service is hacked and passwords revelaed.
Unfortunately, I am getting an "ERROR Failed to access socket path: /var/run/fail2ban/fail2ban.sock. Is fail2ban running" under Debian 12
sir can you make a csrf based video briefly explaining the topic\
Good stuff
Great vid
Where is PicoCTF pt 2 !!!!
So 3 weeks absence and no apologies, no kind words, no nothing ? Tsk tsk tsk…..
Waiting from Nepal
amazing!
我最近刚关注您 我刚开始学网络安全 这东西真的太复杂了 我原来也不懂编程和系统 我只会Microsoft office😹 太可怕了
Amazingly Hackalisious!!!!!