HackTheBox - Derailed

00:00 - Intro
01:00 - Start of nmap
02:50 - Looking at the HTTP Headers, discovering Cross Origin and rails
03:50 - Testing the Clip Notes functionality for SSTI/XSS
06:30 - Using FFUF to fuzz all Clip Notes to see if there's an IDOR Vulnerability
10:30 - Looking at how the site is build, discovering Web Assembly
13:00 - Sending a long string for the username and discovering the data overflows and goes into the Date field
15:50 - Using …

assembly build ffuf fuzz hackthebox headers http idor idor vulnerability nmap origin rails ssti start testing vulnerability web xss