Hack The Box Devzat

00:00 Intro 01:15 Start of nmap 03:00 Poking at the SSH Chat Application 05:10 Running a VHOST Scan and discovering 08:30 Discovering doesn t have a 404 and is a golang webserver 10:55 Fuzzing the user input on pets 14:10 Webapp ignores when a semicolon is at the end of user input, indication to command injection MasterRecon 16:20 Using Gobuster to discover the. git directory and working around the issue of the box having no 404 errors. Use gitdumper to extract. 19:00 Doing some light source code analysis on the Go Binary 23:15 Showing it is also an LFI Vulnerability, just incase command injection was patched 29:00 Reverse shell returned, examining the git log of the files, don t see anything interesting 30:50 Discovering from localhost we can login to chat as anyone, but messages are hidden on Reverse Shells. Switch to SSH and read the messages. 36:40 Looking for an InfluxDB vulnerability via exploitdb,