Part 4: Hacking Web Apps (Verbose - Hack Smarter)
Source: YouTube · Tyler Ramsbey - Hack Smarter · published Sep 11, 2026 · 23:59
This HackSmarter "Verbose" lab (part 4) progresses from the admin flag toward root, confirming server-side template injection (SSTI) in reflected image metadata and identifying Jinja2 as the backend templating engine 1:30, 19:25.
Key Takeaways:
• The admin panel offers multiple attack surfaces—file upload, server status check, promote-user endpoint—with more vulnerabilities than needed to solve the lab 2:10-3:22
• The connectivity check was tested for SSRF/command injection but appears to be a rabbit hole 5:01-6:05
• A valid PNG upload succeeds, revealing a file parameter (potential LFI) and metadata reflected on page—reflected user input is a potential attack vector 6:55-12:55
• LFI fails to escape the upload directory; per KISS, exiftool tampers with metadata, and the artist field is reflected 13:11-16:50
• {{77}} returns 49, confirming SSTI; {{7'7'}} returning repeated 7s identifies Jinja2 via PortSwigger's diagram 18:41-22:35
• Homework: viewers must weaponize the SSTI for RCE/reverse shell to capture the root flag 23:02-23:53
The episode models a disciplined pentest workflow: enumerate attack surface, take notes, test simple attacks first, then methodically confirm and fingerprint SSTI.
Sources:
- 1:30 Recap; goal is RCE for root flag
- 2:10-3:22 Admin panel attack surfaces
- 6:55-12:55 PNG upload; reflected metadata
- 13:11-16:50 LFI fails; exiftool metadata tampering
- 18:41-22:35 SSTI confirmed; Jinja2 identified
- 23:02-23:53 Homework: exploit SSTI for RCE
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Penetration Testing. Commonly maps to: Security Assessment and Testing, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
What is up everyone? Welcome back to another video. This video is going to be part four of working through the verbose web app lab from the hacksmarter platform. This is part four. So if this is the first video that you're watching, I do suggest starting with part one and working through the series in its entirety so you are not lost. Also, you will learn a lot by watching me, but you will learn significantly more by hacking alongside of me. So, if you haven't already, make sure you boot up the verbose lab, boot up C your Cali VM, get your black hoodie on. If you have a hack smarter hat, it does make you a significantly more skilled hacker. So, put on your hacksmarter hat, and then get ready to hack all of the things with me. You will also notice that there is chat over here where my hand …