HackTheBox - Devzat

00:00 - Intro 01:15 - Start of nmap 03:00 - Poking at the SSH Chat Application 05:10 - Running a VHOST Scan and discovering 08:30 - Discovering doesn’t have a 404 and is a golang webserver 10:55 - Fuzzing the user input on pets 14:10 - Webapp ignores when a semicolon is at the end of user input, indication to command injection [MasterRecon] 16:20 - Using Gobuster to discover the .git directory and working around the issue of the box having no 404 errors. Use git-dumper to extract. 19:00 - Doing some light source code analysis on the Go Binary 23:15 - Showing it is also an LFI Vulnerability, just incase command injection was patched 29:00 - Reverse shell returned, examining the git log of the files, don’t see anything interesting 30:50 - Discovering from localhost we can login to chat as anyone, but messages are hidden on Reverse Shells. Switch to SSH and read the messages. 36:40 - Looking for an InfluxDB vulnerability via exploit-db,