XML Object Exfiltration - HackTheBox Cyber Apocalypse CTF "E. Tree"

  Рет қаралды 40,367

John Hammond

John Hammond

3 жыл бұрын

Moving your first steps into hacking? Start from HTB Academy: bit.ly/3vuWp08
Hungry for more hacking training? Join Hack The Box now: bit.ly/331nQCl
For more content, subscribe on Twitch! / johnhammond010
If you would like to support me, please like, comment & subscribe, and check me out on Patreon: / johnhammond010
PayPal: paypal.me/johnhammond010
E-mail: johnhammond010@gmail.com
Discord: johnhammond.org/discord
Twitter: / _johnhammond
GitHub: github.com/JohnHammond

Пікірлер: 76
@joseurena7116
@joseurena7116 3 жыл бұрын
I love the fact that you’re doing CTF stuff, every influencer is doing mostly box pwning and ctfs develop those quick thought skills required. Nice to see a pro do it 👊🏻
@lepsycho3691
@lepsycho3691 3 жыл бұрын
That was fun, I felt the same feeling watching you as I do when I'm not sure if this is the right track or not! Good job!
@durzua05
@durzua05 2 жыл бұрын
Not gonna lie, I was lost on the whole video but I loved it! Insane stuff John!
@mossdem
@mossdem 3 жыл бұрын
Loving these videos as always John! I'm now beginning to actually understand what it is you're writing so its a lot easier to follow along. Keep up the grind, love to see it!
@cedricvillani8502
@cedricvillani8502 2 жыл бұрын
Call me crazy but the way he’s going through this isn’t a normal happening out in the wild. It’s too obvious and too rehearsed, he never went into anything technical, it was more of a Öh of course”kind of thing. WITH everything nice and tidy and human readable, one natural logical discovery flowing into the next, it’s like watching someone go through a page of pseudocode. Idk 🤷 I just have not seen any actual exploits work so fluidly and without any obfuscation put into the so called errors he was getting.
@FrankTranDesign
@FrankTranDesign 3 жыл бұрын
This was fun to watch, thanks JH
@cenkgokce4404
@cenkgokce4404 3 жыл бұрын
Really great solution John, probably I will never figure out that challenge.
@telephonedude
@telephonedude 3 жыл бұрын
I've been really enjoying these videos! I'm a game programmer by trade and this is far enough outside my wheelhouse that I'm learning a ton, but close enough that everything is super easy to follow. A lot of stuff has quickly gotten demystified for me over the past few weeks :p Keep it up!
@cedricvillani8502
@cedricvillani8502 2 жыл бұрын
A real one? Actually that’s mean to say these days, so instead one that designs his own game engines and that does the physics and complex logic, like linear algebra and combinatorics maths (M ̈obius functions for breakfast) OR a GUI drag-n-drop Unreal Engine guy?
@telephonedude
@telephonedude 2 жыл бұрын
@@cedricvillani8502 Says the guy with an "introduction to Unity's new visual scripting tool" vid in his playlist? For reak though, whatever it is that's making you feel so negative, I hope it passes soon
@TheH2OWeb
@TheH2OWeb 3 жыл бұрын
John ! Thanks again ! Just took a little time to get how you reached the second occurence. It clicked just after asking on your Discord :-)
@patrickdonohue4518
@patrickdonohue4518 2 жыл бұрын
Appreciate these videos Sir! Thanks!!
@viv_2489
@viv_2489 3 жыл бұрын
Thanks for great video ... really enjoying python part of solving problems
@andrescappiello1514
@andrescappiello1514 3 жыл бұрын
Amazing John!!
@anthonutty
@anthonutty 2 жыл бұрын
I think one other thing you could have done is provide an XPath that selected the n-th occurrence of selfDestructCode.
@dancingtiger577
@dancingtiger577 3 жыл бұрын
algorithm, love learning by watching you learn
@cedricvillani8502
@cedricvillani8502 2 жыл бұрын
Like algorithms you do? Ok.. Let P = Bn, the Boolean algebra of subsets of {1,2,...,n} ordered by inclusion. Let 2 be the poset with two elements (it has two elements ˆ0 ≤ ˆ1) ✅ WiTh M3 S0 FAR?? OK Cool 😎 SO….. because we can view Bn as a zero-one vector. Let us compute μ for Bn. μ for 2 is given by μ(0,0) = μ(1,1) = 1 and μ(0,1) = −1. With the lemma, we find that μ(T,S) = (−1)|T−S| i.e. μ(T,S) = (−1)# times T and S differ. I think the only thing Mr. Hammond is learning is how to make a KZfaq Video about Hacking, without actually showing any real useable code so it doesn’t get the BAN hammer 🔨 and costing him a ton of money 💰. It is fun fiction though
@aceldama
@aceldama 2 жыл бұрын
watching a sequential string search is fun, but painful - kinda like mxsturbating with a cheese grater. it's easier finding the string length first, then doing a binary search. still, great job getting there. i rather enjoy your content. :3
@user-vq3xv5tz2i
@user-vq3xv5tz2i 3 жыл бұрын
Good content!
@krlst.5977
@krlst.5977 3 жыл бұрын
That was fun, thx
@nothingreallymatters7530
@nothingreallymatters7530 3 жыл бұрын
dude that was awesome
@DirkBaumeister
@DirkBaumeister 3 жыл бұрын
I think the second part would have been easier if you had changed the search to ends-with starting with a closing curly braces and reversing the string afterwards :) nevertheless great video! :)
@chriss8825
@chriss8825 3 жыл бұрын
Yea good idea exploiting known knowledge of the flag. His method would also not work if the first char of the second part of the flag started with a 'C'. My initial idea was to leak name, so you ignore the staff with the first part of the flag completely on your second blind sql injection. My method would have took longer, but in theory it would work irregardless what the second part of flag contained.
@akhileshp3523
@akhileshp3523 3 жыл бұрын
Nice stuff ❤️
@georgehammond867
@georgehammond867 2 жыл бұрын
Leaking the last part of flag was hard. New thing !
@s.aravindh6227
@s.aravindh6227 3 жыл бұрын
Nice video bro 👍👍
@praetorprime
@praetorprime 3 жыл бұрын
Great content, as always! I seem to learn something new that I should've already known, every time.
@Skavin1000
@Skavin1000 3 жыл бұрын
This felt a bit like everything looking like a nail once you have a hammer. owe knew the key ended with } so maybe "ends-with" would have been easier for the second part?
@cedricvillani8502
@cedricvillani8502 2 жыл бұрын
It’s a logical flow, so anyone, even people who don’t program can follow along and even guess at the answer before he types it. Very mentally rewarding, I mean even the error’s were giving pseudocode answers.
@dedkeny
@dedkeny 3 жыл бұрын
Almighty ALGO!!!
@jannikmeissner
@jannikmeissner 3 жыл бұрын
Could be a really stupid question, but what is actually the limiting factor in the speed of trying different characters? Is it Network speed to the box or could it be made faster if you used multi threading to try multiple possible combinations at once?
@AlexElement
@AlexElement 3 жыл бұрын
John, what song is the Outro , it sounds like a very cool instrumental? :D
@abhayakarte5207
@abhayakarte5207 3 жыл бұрын
Nice
@SecurityTalent
@SecurityTalent 2 жыл бұрын
Great
@kennymd
@kennymd 3 жыл бұрын
I feel like John is gonna be so hyped about Python 3.10's new match-case statement
@nothingnothing1799
@nothingnothing1799 3 жыл бұрын
@@propapanda420 doesn't need END
@kennymd
@kennymd 3 жыл бұрын
@@propapanda420 It's basically switch-case on steroids
@overgrowncarrot1
@overgrowncarrot1 2 жыл бұрын
@johnhammond, don't know if this will help in the future but there is xcat for kali that can be used. I know you use parrot and Ubuntu and stuff, but xcat is a tool for XPath injection and can be used with blind XPath. I learned about it in eWPT
@cedricvillani8502
@cedricvillani8502 2 жыл бұрын
He knows, it was even in the document he showed in the beginning, but would not have made a very entertaining story. Not to mention it would be to close to something someone could do in the real world and possibly cost him his KZfaq channel, and that is a big $$$ deal. I wouldn’t see why he would risk it, he probably wrote this CTF in the first place. John has taken on and beaten ppl in the real world, like at Def-Con.
@RikhiRozzay
@RikhiRozzay 2 жыл бұрын
Are you doing all of this on a VM, wsl2 or Linux os?
@berndeckenfels
@berndeckenfels 3 жыл бұрын
I am not sure what the { did in the string concatenation, but both expressions should work without it as only the fist flag part starts with it.
@capability-snob
@capability-snob 3 жыл бұрын
Do you usually find on a job you are guessing how the sql or xpath that the developer wrote is structured or do cheat sheets and scripts usually get you all the way there?
@cedricvillani8502
@cedricvillani8502 2 жыл бұрын
HAHA right , I wish when I got errors they gave me the fix and clue to the next step in Pseudocode
@prateekkuber8444
@prateekkuber8444 3 жыл бұрын
Can someone help me understand how exactly the second part worked for the second part of the flag!?!
@chillydickie
@chillydickie 3 жыл бұрын
Ive always wondered if randomizing (sampling characters without replacement) the character guesses would improve the likelihoood of finding one sooner.
@chriss8825
@chriss8825 3 жыл бұрын
Probably would not be worth it the time/effort to code it. Adding an underscore as the first character would speed things up (saves ~70 attempts for each underscore in the flag, but only adds one extra attempt for all other characters), but even that is probably not worth the effort.
@cedricvillani8502
@cedricvillani8502 2 жыл бұрын
This whole thing is silly 🙃, like in the movies back in the day when the “Secret Launch Codes”were being figured out, while James Bond was fighting the Evil Genius.
@Lexxrt
@Lexxrt 3 жыл бұрын
Hello, Computer? - John Hammond 2021
@raspberrypi4970
@raspberrypi4970 2 жыл бұрын
Or Star Trek IV when Scotty grabbed the computer mouse and tried to talk to it saying, "Hello Computer ." 🤣🤣
@LiEnby
@LiEnby 3 жыл бұрын
im confused how that 2nd injection even worked lol i kept saying the answer was //selfDestructCode[1].StartsWith or whatever
@arivanhouten6343
@arivanhouten6343 3 жыл бұрын
The outro is just build different
@elizabethsheriff5075
@elizabethsheriff5075 6 ай бұрын
Hay, how can someone contact you for a CTF teaching
@rasooledwards3129
@rasooledwards3129 2 жыл бұрын
Can you do a video of you explaining your videos. The methods you're using and your mindset when you're faced with the challenge.
@ko-Daegu
@ko-Daegu 2 жыл бұрын
You are kidding right ?
@rasoolnjesus
@rasoolnjesus 2 жыл бұрын
@@ko-Daegu no, you must not get the question.
@cedricvillani8502
@cedricvillani8502 2 жыл бұрын
You mean explains how to not only code the problem (ex. CTF) but also do a human readable “hack”that won’t actually work in the real world? Because yes I’m also curious, and I wonder if he employs a few other programmers to make sure he doesn’t step to far outa line and cost him a lot of money
@_AN203
@_AN203 3 жыл бұрын
5INALLY !!! Some john hammond things sorry that i haven't watched the stream because of the dummy isp Edit : me see john do some blind things and it works 😐🤨😬🤯🤯🤯😵
@BRYDN_NATHAN
@BRYDN_NATHAN 3 жыл бұрын
11:14 confusion it creates entropy thank you 13:51 [✓] moving "toward" a limit, [✓] moving "towards" a limit
@shirshak3699
@shirshak3699 3 жыл бұрын
I hope HTB discord would be better than THM in terms of helping people who dont know how to solve something and also the mods😅
@GunniBusch1
@GunniBusch1 3 жыл бұрын
Can you make Hardware hacking?
@anirvinyasharma6455
@anirvinyasharma6455 3 жыл бұрын
what Linux distro is Mr. John using ??
@nothingnothing1799
@nothingnothing1799 3 жыл бұрын
Ubuntu i think
@user-vq3xv5tz2i
@user-vq3xv5tz2i 3 жыл бұрын
@@nothingnothing1799 +
@thedoctor2880
@thedoctor2880 3 жыл бұрын
@@nothingnothing1799 What DE tho?
@HoaPham-rg8rm
@HoaPham-rg8rm 3 жыл бұрын
What is problem with python 2 ?
@viniciusdaltro5220
@viniciusdaltro5220 3 жыл бұрын
hello yt algorithm
@abdulrahmanfaisal288
@abdulrahmanfaisal288 3 жыл бұрын
Hello
@chetanpatil2473
@chetanpatil2473 3 жыл бұрын
please start with basic to advanced daily 1 ctf basic to advanced 🙏
@nothingreallymatters7530
@nothingreallymatters7530 3 жыл бұрын
more x path injection
@qualtersty
@qualtersty 2 жыл бұрын
22:20 I'm no hacker lol but I'm pretty sure you could've reversed the original script to check using XPath ends-with instead of using starts-with.
@bhagyalakshmi1053
@bhagyalakshmi1053 11 ай бұрын
Burp suite 4woinders one 🕐 nod pasbul
@wolfgtweb
@wolfgtweb 2 жыл бұрын
I have watched a lot of you videos and enjoy them. I guess I finally have to ask. Why is your face on the screen? It doesn't benefit the viewer at all. In fact all it does is get in the way. Is it an ego thing?
@cedricvillani8502
@cedricvillani8502 2 жыл бұрын
It’s a BRAND thing.
Blind MongoDB NoSQL Injection - HackTheBox Cyber Apocalypse CTF
19:11
TryHackMe! Bypassing Upload Filters & DirtySock
53:38
John Hammond
Рет қаралды 67 М.
0% Respect Moments 😥
00:27
LE FOOT EN VIDÉO
Рет қаралды 39 МЛН
Buy Feastables, Win Unlimited Money
00:51
MrBeast 2
Рет қаралды 62 МЛН
GraphQL Introspection - HackTheBox "Business CTF" - NoteQL
14:34
John Hammond
Рет қаралды 30 М.
Going to Chinese Hacking Competition - Real World CTF Finals
12:47
LiveOverflow
Рет қаралды 1,5 МЛН
Finding WEIRD Devices on the Public Internet
27:48
John Hammond
Рет қаралды 156 М.
Sora has a New Trick! Plus a Dive into the Latest Features & Music Video
9:35
Plundering AWS S3 Buckets - HackTheBox
1:04:04
John Hammond
Рет қаралды 73 М.
Cloudflare CDN CSP - XSS Bypass / HackTheBox Cyber Apocalypse CTF
40:49
Exploiting Tomcat with LFI & Container Privesc - "Tabby" HackTheBox
45:54
These Files Don't Show Their Extension
41:26
John Hammond
Рет қаралды 15 М.
SQLite Blind SQL Injection - HackTheBox Cyber Apocalypse CTF
35:25
John Hammond
Рет қаралды 70 М.
The ARM chip race is getting wild… Apple M4 unveiled
4:07
Fireship
Рет қаралды 477 М.
0% Respect Moments 😥
00:27
LE FOOT EN VIDÉO
Рет қаралды 39 МЛН