▶️ YouTube: https://www.youtube.com/c/PinkDraconian ? Twitter: https://twitter.com/PinkDraconian ? TikTok: https://www.tiktok.com/@pinkdraconian ℹ️ LinkedIn: https://www.linkedin.com/in/robbe-van-roey-365666195/ ? Discord: PinkDraconian#9907 ? Instagram: https://www.instagram.com/robbevanroey/ ?️ Website: http://pinkdraconian.d4rkc0de.com/ ?‍? HackTheBox: https://www.hackthebox.eu/home/users/profile/129531 Platform: CyberSecLabs Platform Link: https://www.cyberseclabs.co.uk/ Category: Machine OS: Linux Challenge name: Fuel Difficulty: 2/10 00:00 Introduction 00:15 Nmap scan 00:30 Fuel CMS, version 1.4 - Exploit 01:20 Looking into the Fuel CMS RCE exploit 01:40 URL decoding with CyberChef 02:00 Running the RCE, fixing errors 03:30 Getting RCE, finding the private RSA key to get SSH access 05:20 Checking the .bash_history file to find a plaintext password 06:00 Using the password to su to root ... https://www.youtube.com/watch?v=cAVaHenL7s8

? #BugBounty Recap ? ? February 3rd ⏰ @Zomato Subdomain Takeover by @moe1n1

▶️ YouTube: https://www.youtube.com/c/PinkDraconian ? Twitter: https://twitter.com/PinkDraconian ? TikTok: https://www.tiktok.com/@pinkdraconian ℹ️ LinkedIn: https://www.linkedin.com/in/robbe-van-roey-365666195/ ? Discord: PinkDraconian#9907 ? Instagram: https://www.instagram.com/robbevanroey/ ?️ Website: http://pinkdraconian.d4rkc0de.com/ ?‍? HackTheBox: https://www.hackthebox.eu/home/users/profile/129531 Twitter: https://twitter.com/PinkDraconian Discord: PinkDraconian#9907 Website: http://pinkdraconian.d4rkc0de.com/ Platform: CyberSecLabs Platform Link: https://www.cyberseclabs.co.uk/ Category: Machine OS: Windows Challenge name: Boats Difficulty: 1/10 00:00 Introduction 00:12 Running nmap on the windows box 00:30 Running gobuster on port 80 01:00 Doing manual enumeration on port 80 whilst waiting for our automatic recon to finish 01:45 Looking at the output from gobuster and checking the phpmyadmin file 02:07 Checking out the open phpmyadmin portal 02:35 Using phpmyadmin to get a shell on the box through uploading php code with a sql query 03:40 Checking out hacktricks to look for a good reverse shell in windows, we decide to user certutil 04:40 Using msfvenom to create a reverse meterpreter binary 05:35 Uploading our binary with certutil and running it 06:55 Using metasploit to catch our reverse meterpreter shell with exploit/multi/handler ... https://www.youtube.com/watch?v=TwmHAzu0AeY

? #BugBounty Recap ? ? January 30th ⏰ @imgur Reflected XSS by whoami991