TryHackMe - Second

Buy Me A Coffee :)

Chapters:
0:00 Intro
1:10 Nmap scan and report
3:00 Looking at the website
7:15 Trying for Second Order SQL Injection
8:15 SQL Injection creates an error
9:00 Boolean Injection bypasses login
10:40 Explaining Union Injection to extract information
12:00 Finding columns with Union Injection script
21:30 Script shows that there are four columns
22:25 Writing another script to extract information
28:15 Extracted databases. Enumerating tables
31:10 Extracted tables. Going for credentials
32:45 Credentials found. SSH access to the server
35:35 Finding a local website for lateral movement
39:10 Looking at Flask common vulnerabilities
40:10 Looking at Second Order Server Side Template Injection
42:20 SSTI confirmed. WAF test blocks a common payload
43:55 Looking at blacklist and how to bypass it
45:00 Blacklist bypassed. Getting reverse shell
47:30 Dropping SSH keys
48:00 Looking at first hint for root step
49:50 Looking at second hint for root step
53:05 Looking at third hint using Linpeas
58:35 Looking at fourth hint using Pspy
1:00:55 Intercepting GET request
1:02:05 Easy way of intercepting credentials
1:06:00 Realistic way of intercepting credentials
1:30:10 Getting root with captured credentials