00:00 - Introduction
01:00 - Start of nmap
03:15 - Identifying all the technologies used in the box
10:45 - Looking at OpenStack Keystone Authentication and discovering CVE-2021-38155
12:15 - Pulling up API DOCS to see how to login to Keystone, then testing lockout
14:00 - Taking the Burpsuite Request, sending it to FFUF and using a trick to try each password multiple times
25:30 - Attempting to access Swift as a vendor to bypass auth, using GoBuster and discovering an Android directory with Pokatmon app in it
35:10 - Start of analyzing the Pokatmon App, examining DNS, setting up a MITM with Burpsuite and Socat
40:15 - Using Frida to disable TLS Certificate Pinning on Flutter
45:20 - Discovering the App Signs every request, grabbing the certificate out of the app, and signing our own request
49:20 - Performing an SQL Injection, getting an email address then looking for vulnerabilities in Forgot Password on the main website
58:48 - Discovering CVE-2021-43557 in APISIX, which gives us an idea to URLEncode Paths to bypass blacklists and gaining access to the /private/ directory which has a /forgot-password we can use to reset Roger's password
1:04:45 - Logging into the docs, gaining access to the API and finding an LFI
1:09:45 - Looking into CVE-2021-35368, which is a ModSecurity Bypass that allows us to abuse the LFI
1:18:10 - Using NGINX's temporary files with our PHP LFI to gain code execution
1:27:55 - Shell returned on Pokatdex-API, exporting Kubernetes secrets
1:34:20 - Discovering an APISIX admin key and exploiting this service by creating a route that executes code
1:59:20 - Shell returned on the APISIX box, discovering credentials we can SSH with
2:11:10 - Explioting the CRI-O with Kubernetes to set a kernel param to execute a script when a core dump is created (CVE-2022-0811)
Support the originator by clicking the read the rest link below.
