00:00 - Introduction
00:53 - Start of nmap
02:50 - Examining the webpage, just finding json. Running gobuster to discover /docs and /api
04:20 - Examining the user and admin endpoint, showing /user/ has a 404 but we can go into it
05:10 - Talking about why API Discovery differs from normal web, instead of extensions we fuzz methods
07:15 - Using wfuzz to fuzz endpoints in /user/ with POST Requests to discover /login and /signup
09:50 - Fuzzing the signup endpoint, reading error messages to identify the fields it wants
11:40 - Showing that curl behaves differently. Lets troubleshoot this by sending our curl and burpsuite to wireshark and seeing why its behaving differently
14:24 - Attempting to login to the API with the credential we created, discovering we need a urlencoded request
16:30 - Logging in and getting a JWT Token, accessing /docs/ with it which is swagger documentation
19:10 - Authenticating in the swagger, so we can use the web interface to access private functions
19:58 - Changing administrators password with the UpdatePass endpoint, which is an IDOR like vulnerability
20:30 - Logging in with admin, then accessing the admin functionality
22:30 - Exploring the /proc/self directory with the LFI and finding where the source code to this app lives
25:00 - Extracting the JWT Secret Key from app/core/config.py, and adding the debug parameter, which enables us to access the /access endpoint
26:20 - Showing we cannot use slashes or pluses on this endpoint
28:40 - Getting a reverse shell
29:29 - Discovering the root password in an authentication log, because someone entered a password in a username field
32:20 - Just looking at the code briefly. Should have prepared more to do this. Will probably do a separate video showing FastAPI.
Негізгі бет UHC - Backend
Пікірлер: 34