Guessing vs. Not Knowing in Hacking and CTFs
5,007I really hate it when I have to guess stuff. This applies to CTFs, but also to my real-world work in penetration testing. It is incredibly frustrating to bruteforce or guess something, that could just be read in the source code. I much rather focus on technical details, tricks and techniques.
Try the XSS challenge: https://hacking.app/xss/xss_chall1.html#welcome
Failed DOM Clobbering Research part 1/2: https://www.youtube.com/watch?v=dZXaQKEE3A8
Chaining Script Gadgets to Full XSS part 2/2: https://www.youtube.com/watch?v=UGtrpXk6QVU
00:00 - Introduction
00:37 - Steganography in CTF
01:38 - Dirbuster & Asset Discovery
02:21 - XSS Example (see description)
02:53 - Global Variables in JavaScript
03:21 - The window.name Variable
03:55 - Is this Guessing?
04:20 - Example Solution Walkthrough
06:00 - Benefits of this Challenge
07:20 - The Importance of Scanning
08:19 - Scanning vs. Reading Code
08:57 - Improve Steganography Challenges
10:22 - Summary
11:10 - Outro
-=[ โค๏ธ Support ]=-
โ per Video: https://www.patreon.com/join/liveoverflow
โ per Month: https://www.youtube.com/channel/UClcE-kVhqyiHCcjYwcpfj9w/join
-=[ ๐ Social ]=-
โ Twitter: https://twitter.com/LiveOverflow/
โ Instagram: https://instagram.com/LiveOverflow/
โ Website: https://liveoverflow.com/
โ Subreddit: https://www.reddit.com/r/LiveOverflow/
โ Facebook: https://www.facebook.com/LiveOverflow/