Channel: LiveOverflow

Category: Science & Technology

Tags: web hackingliveoverflow0-dayreal world ctfcapture the flagrealworld ctfmicroserviceslive overflowhacking tutorialreal worldctfhttp headerssrfapi keyvulnerabilityhow to hackexploit tutorialx-real-iprealistic ctfbugzerodaysecurity research0dayserver side request forgerypentestadmin apizero day

Description: In this video we perform a code audit of Api6 and discover a default configuration that can be escalated to remote code execution. CVE-2022-24112: seclists.org/oss-sec/2022/q1/133 GitLab: liveoverflow.com/gitlab-11-4-7-remote-code-execution-real-world-ctf-2018 Challenge files: github.com/chaitin/Real-World-CTF-4th-Challenge-Attachments/tree/master/API6 Chapters: 00:00 - Intro 01:09 - Initial Application Overview 02:15 - Discussing Approaches 03:56 - Reading Documentation 04:57 - Initial Attack Idea 06:15 - Identifying Attack Surface 08:46 - Discovering Batch Requests 09:18 - Bypassing X-Real-IP Header 10:15 - Testing the Exploit 11:11 - Reporting the Issue 12:16 - Outro -=[ ❤️ Support ]=- → per Video: patreon.com/join/liveoverflow → per Month: youtube.com/channel/UClcE-kVhqyiHCcjYwcpfj9w/join -=[ 🐕 Social ]=- → Twitter: twitter.com/LiveOverflow → Instagram: instagram.com/LiveOverflow → Blog: liveoverflow.com → Subreddit: reddit.com/r/LiveOverflow → Facebook: facebook.com/LiveOverflow