Laravel CVE / PHP Deserialization - 'Larablog' HTB Business CTF

[flaxeneel]

wow that was fun to watch, i honestly didn't know about that nginx misconfig. uhhh time to go recheck all of my configs coz thats pretty scary

[Operaatoors]

I’ve always been no trailing slash guy, but now I am thinking going to be always tailing slash guy

[masterjiggle]

Damn man... Its so awesome to watch you do this.. Keep it up

[justgiz]

I had no idea what was going on until the last few moments. No idea what Capture the Flag had to do with Laravel. But you're actually playing Capture the Flag. Interesting.

[theDeparted]

its mind blowing to see so many chrome tabs open at the same time🤣

[MartinKrisell]

A small clarification – the .env file is gitignored because different environments uses different .env values, and to keep this away from source control, but not because we want to exclude/hide it from a production environment. Of course, there are also other ways to set environment variables in a production runtime.

[MattMcT]

John… lovely work as always dude! Cheers! [checks path mods]

[vivekchoudhary]

FYI, Azure VMs are not "pingable", Microsoft for some reason removed this feature from Azure VMs

[SumanRoy.official]

Hi John, just need some knowledge that I am trying to figuring out recently, currently I am fiddling around with Java, and interesting thing I found about it was that Windows 10 does not check for Code Sigining of a Jar file but if I deploy a simple hello world written in C/C++, exe file on a different computer it detects it as a malacious file and does not let user to run it. What are the edge cases that will prevent someone from writting a Java based virus or a ransomware to go undetected by a security endpoint given the fact writing obfuscate code to prevent behavioural analysis by security.

[DcWHaT]

Wow John your amazing!! Thank you for all the amazing how-tos! I’m curious how long did this take you to do? Your real time, keep it up. God bless.

[Aolpha]

What's the cookies plugins, John?

[JNET_Reloaded]

Interesting, any other / exploits we should know about to path our systems?

[phoenixzeu]

Hey John, can you do Etituber? I'm curious about the XXE payload...

[leosnavratil]

What version of Xubuntu does the VM have?

[MatteoGariglio]

I am not super familiar with command line: what does "cat /tmp/f | sh -1 2>&1" actually do? Thanks John, your videos are really awesome!

[quangvo]

Hey John. I wonder if i can solve these challenges after the ctf is over ?. I want to practice on my own

[penry]

could you access the .env file? *EDIT* lol I was way too impatient.

[comdeyoverflow]

Hey John, I notice that you always solve more web challenge in HTB Business CTF. I think that your channel root is reversing or crypto. Can i know the reason?😊

[zeepranabesh]

Sir,
I want to build a booking website using php, html and css. If I don't learn javascript is it possible to make it

[sandra]

I am posting all the information of identity thefts scammers as I am building myself to be unstoppable success of my own