CTFs have a learning curve I’ve been trying to master for months now... I’ve been burnt out and a bit depressed because of it. It’s nice to see your videos though can be a good source of motivation
Happy to hear that! I get burned out and pretty bummed with all the stuff going on too. Just gotta stay on the grind and take breaks when you feel you need to! Thanks for watching!
When i watch ur video i almost understand 20-30% of it.. and that other 70-80% make me more excited.. finally getting new content worth watching from youtube.. Thanks 😀
Nice to know. XXE Injection is greate. I learn much of the video and know how to secure my own server against. Thanks for this video to share with us. Great Job!
Wow. I solved some of the challenges in this particular CTF, but this video provided really great insight for that injection problem. Thanks @John Hammond.
Thanks so much for watching! Currently I have 15 videos in the backlog for ACICTF, and I hope to release them each Monday/Wednesday/Friday. Once the challenges come back up I'll try and record more, and hopefully solve some others too!
I'm hooked up with your videos :D As web developer I know the normal way how server works, but this exploit, it blew my mind :O I've never imagined such possibilities .
More TryHackMe coming up! I try to release videos for THM each Tuesday and Thursday. I know I've got to do more KOTH, so many people keep asking for it. Maybe I'll have to pivot to Twitch to do some of those! Thanks so much for watching
Hey john i was going good with you until u did make.php ?countr y' , how did you call the cou ntry and then you started new comand ,,, i think i did understand that when i was explaining that lol thnk you
You're right, the reverse shell wasn't entirely necessary -- but I think it is good to do whenever you can, maintain some easier access on the box. In case the binary needed like a full PTY or if it had some gimmicks like requiring input, I certainly prefer to have the command-line control. Thanks for watching!
True! But, hey, whats to stop us from having full access and nice-and-easy command control :) I think whenever you _can_ get a full reverse shell, it is a good thing to go for!
@@robertadamplant Well, keep in mind I had solved this previously (and that probably took like 3-4 hours, who knows) but the video is an after-the-fact writeup with a little acting artifice to sprinkle some curiosity and entertainment into the video ahaha. Thanks for watching! I can definitely showcase Move ZIG! That should come next week!
Hey jhon this is from a person who is not so experienced in this genre and I want to actually understand what you are saying Im new to programing and even a bigger noob in pen testing and try hack me stuff it would be really helpful if you could tell me what i should start with thankyou 😄😄
Have you checked out some of my other videos? TryHackMe has a lot of great stuff for beginners! And are you tracking some of the upcoming games on CTFtime.org, have you worked through Bandit from OverTheWire?
If the PHP code is reflecting the input ino the web page, then why didn't he just used php?? He could just have used this: If in the web page is 1 ( in the title ), then there is an easy RCE... Why didn't he realized it right after seeing this? 🤣
I will always be an absolute beginner, probably even 50 years from now -- still more to learn! And hey it's a dirty CTF script, a flag is a flag ;) Thanks so much for watching!
You're right, you totally could -- I guess I prefer getting the reverse shell whenever possible, so I am not unknowingly fighting against bad characters or weird things that might get in the way. But yeah, you could just execute it in the current directory or try strings and get your flag easily enough :P Thanks for watching!
CTFs have a learning curve I’ve been trying to master for months now... I’ve been burnt out and a bit depressed because of it. It’s nice to see your videos though can be a good source of motivation
Happy to hear that! I get burned out and pretty bummed with all the stuff going on too. Just gotta stay on the grind and take breaks when you feel you need to! Thanks for watching!
When i watch ur video i almost understand 20-30% of it.. and that other 70-80% make me more excited.. finally getting new content worth watching from youtube..
Thanks 😀
John, these videos keep me motivated and I’ve learned so much . Thank you very much for all you effort! You’re helping me in so many ways.
John you are inspiring me and moreover you are fun to watch. Keep up the good work! Greetings from Greece.
Very happy to hear that! Thank you so much!
CTFs and tryhackme rooms are some of the most entertaining yet informative videos of yours. Thank you!
Happy to hear that! Thank you so much for watching!
just wow! xml is really vulnerable! thank you for your job
Nice to know. XXE Injection is greate. I learn much of the video and know how to secure my own server against. Thanks for this video to share with us. Great Job!
Keep them coming John. Very informative!
Wow. I solved some of the challenges in this particular CTF, but this video provided really great insight for that injection problem. Thanks @John Hammond.
Thanks so much for watching! Currently I have 15 videos in the backlog for ACICTF, and I hope to release them each Monday/Wednesday/Friday. Once the challenges come back up I'll try and record more, and hopefully solve some others too!
I'm in love with this format !!! Continue like this or better ;)
Hi, from Italy🙂
Stay safe in Italy
Okay that's interesting and insane at the same time ...thanks John
Ha, ACICTF had some really cool challenges! Thanks so much for watching!
Super duper cool challenge and explaination 👍
I'm hooked up with your videos :D
As web developer I know the normal way how server works, but this exploit, it blew my mind :O
I've never imagined such possibilities .
John. you, my friend, are awesome.
OMG. Brilliant! Thanks for sharing
Thanks so much for watching!
hope to reach your level of mastering all this... you're so damn good !! incredible !!
Thanks man!
Awesome, bro!
That was one excellent video!
Thank you so much! And thanks for watching!
Awesome video!
but I'm curious, if you would've sent in the title CYBER and then ran the xxe
wouldn't it solve the one-liner wrapper issue?
mind-blowing...... thanks man
Thanks so much for watching!
Very cool video as always!
Happy to hear that, thank you for watching!
Well now I know what I would do this summer)
can't get enough of your videos! very entertaining and educational as well, please do more of these and also try hack me's :)
More TryHackMe coming up! I try to release videos for THM each Tuesday and Thursday. I know I've got to do more KOTH, so many people keep asking for it. Maybe I'll have to pivot to Twitch to do some of those! Thanks so much for watching
Nice vid as always, anyways have u replaced ls with exa? And if yes whatare your aliases like ll ls la etc.
Great!
Thanks for watching!
From a Hobbyist web dev point of view these videos really help to highlight where the vulnerabilities are in my code.
Ty for ur damn nice videos! Can u make a video about ur hacking setup like where did u host ur server, which programs u use etc.
wo jhon :D Mind Blowing
Thank you so much for watching!
Hey john i was going good with you until u did make.php ?countr y' , how did you call the cou ntry and then you started new comand ,,, i think i did understand that when i was explaining that lol
thnk you
why did you need the reverse shell? At the point where you could run id, couldn‘t you have just ran ./flag like the hint suggested? :)
You're right, the reverse shell wasn't entirely necessary -- but I think it is good to do whenever you can, maintain some easier access on the box. In case the binary needed like a full PTY or if it had some gimmicks like requiring input, I certainly prefer to have the command-line control. Thanks for watching!
WOW
Thanks for watching!
♥️
Hi, you didn't need to make revshell, you could just read dir content and execute it after breaking out of sed command.
He probably did it just because that is what he felt most comfortable with.
True! But, hey, whats to stop us from having full access and nice-and-easy command control :) I think whenever you _can_ get a full reverse shell, it is a good thing to go for!
yep i thought the same , just read the flag right but tbh he will have to use multiple commands and decode everytime right cause its a binary
why is it suspended
You did this in under 30 minutes? Dude.
Please can you do a walk through of how you solved Move ZiG? I was (and still are) debugging my client side script.
@@robertadamplant Well, keep in mind I had solved this previously (and that probably took like 3-4 hours, who knows) but the video is an after-the-fact writeup with a little acting artifice to sprinkle some curiosity and entertainment into the video ahaha. Thanks for watching!
I can definitely showcase Move ZIG! That should come next week!
i love you
Plicked!
That was a bit of a brainfuck, but good job man.
Hey jhon this is from a person who is not so experienced in this genre and I want to actually understand what you are saying Im new to programing and even a bigger noob in pen testing and try hack me stuff it would be really helpful if you could tell me what i should start with thankyou 😄😄
Have you checked out some of my other videos? TryHackMe has a lot of great stuff for beginners! And are you tracking some of the upcoming games on CTFtime.org, have you worked through Bandit from OverTheWire?
Ah I think we could have used the data:// or expect:// php wrapper to get RCE quickly haha. Ot maybe they were blacklisted...
If the PHP code is reflecting the input ino the web page, then why didn't he just used php?? He could just have used this:
If in the web page is 1 ( in the title ), then there is an easy RCE...
Why didn't he realized it right after seeing this? 🤣
only an absolute beginner codes like that but, nevertheless a fun challenge
I will always be an absolute beginner, probably even 50 years from now -- still more to learn! And hey it's a dirty CTF script, a flag is a flag ;)
Thanks so much for watching!
could you not just strings the ./flag and sed new lines to a single line? no need for BYOB or revshells.
You're right, you totally could -- I guess I prefer getting the reverse shell whenever possible, so I am not unknowingly fighting against bad characters or weird things that might get in the way. But yeah, you could just execute it in the current directory or try strings and get your flag easily enough :P Thanks for watching!
HC
hello，can you addition subtitle in your video，3Q
If you turn on closed captioning/subtitles that might help! Thanks so much for watching!
first?
You got it!