Skip to main content
CPEBuddy
HackTheBox - Certificate

HackTheBox - Certificate

Source: YouTube · IppSec · published Oct 4, 2025 · 52:36

Penetration Testing
No ratings yet Log in to rate
Transcript Available
Description

This video demonstrates two methods for bypassing a PHP file upload filter on the Hack The Box "Certificate" machine. 0:00

Key Takeaways:
• The target application accepts zip files and unzips them into a directory, checking file extensions to prevent dangerous uploads. 0:06
• The first bypass technique uses a null byte in the filename to truncate the extension check, allowing a PHP file to be saved. 0:18
• The second, more novel technique is "zip stacking," where two zip files are concatenated using cat to exploit different zip parser behaviors. 0:27
• In zip stacking, some programs read the first file while others read the second, allowing a malicious payload to be hidden. 0:30

Understanding these bypasses highlights the risks of relying solely on client-side or simple extension-based validation in file upload systems.

Sources:

  • 0:00 Introduction to the Certificate HTB machine
  • 0:06 Description of the zip file upload vulnerability
  • 0:18 Explanation of the null byte bypass technique
  • 0:27 Introduction to the zip stacking attack method
  • 0:30 Details on how zip stacking exploits parser differences

Generate CPE Credits

Generate a professional CPE document from this video's transcript.

Estimated credit: 1 CPE hours

Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.

Topic: Penetration Testing. Commonly maps to: Security Assessment and Testing, Security Operations. Exact CISSP domains are assigned during generation.

CISSP Domain Mapping
Learning Objectives
Self-Assessment Questions
PDF Export Ready

Free account. One generation at a time, with a daily limit.

CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.

Watch on YouTube

Transcript Preview

First 800 characters of the transcript

What's going on YouTube? This is Ippsec, we're doing certificate from Hack The Box, which starts off with a pretty niche but cool file upload exploit in a PHP application. It accepts zip files and will unzip it into a directory, but it checks the extensions before performing that unzip operation to try to prevent any dangerous files from being uploaded. I'll show you two ways to bypass this filter. The first by inserting a null byte, so when it creates the file it chops off a portion of the file letting us have a PHP file. The second way I find extremely cool, it was used in a fishing attack, it's called zip stacking. Where you just use cat to combine two zip files into one. Some zip programs read the first file, others read the second file, and it's a pretty cool attack that I recommend y…