A complete beginner's guide to Web Hacking | by CertBros
Source: YouTube · Hack The Box · published Mar 28, 2023 · 22:24
This workshop demonstrates a beginner's guide to web hacking through a walkthrough of the "Intergalactic Post" CTF challenge 1:23, where Sam Thompson explains how to identify and exploit SQL injection vulnerabilities.
Key Takeaways:
• The presenter uses Burp Suite to intercept and analyze web requests, discovering email validation on the front end 2:15-5:10
• Examining the source code reveals the application uses SQLite database and is vulnerable to SQL injection via the X-Forwarded-For header 11:56-13:43
• A successful SQL injection attack is crafted by modifying the HTTP header, allowing code execution on the server 18:09-20:11
The workshop concludes by showing how to locate the flag file, though its contents are not revealed to encourage viewers to attempt the challenge themselves 21:12-21:44.
Sources:
- 1:23 Introduction to the "Intergalactic Post" CTF challenge
- 2:15-5:10 Using Burp Suite and discovering email validation
- 11:56-13:43 Identifying SQL injection vulnerability
- 18:09-20:11 Executing SQL injection attack
- 21:12-21:44 Finding the flag
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Penetration Testing. Commonly maps to: Security Assessment and Testing, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
foreign to this Workshop now before we do anything I just want to say a massive thank you to the team over at hack the box for putting on such a great event but for also inviting me to come along and take part now this is my first cyber apocalypse talk but hopefully just one of many now this Workshop is all about a beginner's guide to web hacking now before we jump into that though however as I'm aware of most of you probably don't know who I am I just want to take a quick second to introduce myself so my name is Sam Thompson I have scarily thinking about it 10 plus years of it experience now about seven of those is in the security space working for some of the world's largest security vendors now aside from my day job I also teach computer networking and security and I've also put in an a…