Web Hacking 101 | by NahamSec
Source: YouTube · Hack The Box · published Mar 21, 2023 · 16:05
The video demonstrates how to exploit a Hack The Box challenge called "Mutation" by leveraging server-side vulnerabilities in an SVG export feature to ultimately forge an admin session and retrieve the flag 15:06.
Key Takeaways:
• Initial reconnaissance reveals a base64-encoded session cookie containing the username, with attempts to modify it to admin failing due to signature validation 1:36-2:24
• The SVG export functionality is identified as a potential attack vector for SSRF/XXE since it processes SVG files server-side to convert them to PNGs 3:05-3:32
• A malicious SVG with an iframe successfully reads the /etc/passwd file, confirming the SSRF vulnerability which is then used to access the application's source code 4:48-5:27
• The session secret key is discovered in the .env file, allowing for the possibility of forging valid session signatures 6:45-6:51
• A Python script is created to replicate the HMAC-SHA1 signing mechanism used by cookie-session, generating a properly signed admin session 9:55-13:48
The presenter successfully uses the forged admin session to access the dashboard and retrieve the challenge flag, demonstrating the complete exploit chain from initial vulnerability discovery to privilege escalation 14:54-15:06.
Sources:
- 0:03 Introduction to the Mutation box challenge
- 1:36-2:24 Session analysis and failed modification attempt
- 3:05-3:32 Discovery of SVG export vulnerability
- 4:48-5:27(https://www.youtube.
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
hey what's going on everybody uh my name is Benson digapore but most of you online know me as nahomsek and I'm excited to do the mutation box uh from last year's event but before we do all of that I want to quickly give a big shout out to the hack the Box team for putting this amazing event together I hope you all are having fun and enjoying this event but seriously thank you so much for putting this together and thank you so much for having me as a part of this CTF challenge in this entire event as a whole so before we get into it just a quick explanation this box again is called mutation it's on hack the box you can follow along as well all you have to do is go on their website load up the box and follow along if there's anything like a piece of code or POC that I write up it is all on h…