HackTheBox - Soccer

00:00 - Introduction
01:00 - Start of nmap, assuming the web app is NodeJS based upon a 404 message
04:20 - Running Gobuster and discovering Tiny File Manager
06:00 - Looking for the source code and finding a default password of admin@123
06:45 - Navigating to uploads and attempting to upload a php shell to the website
07:45 - Getting a reverse shell with our php shell
09:00 - Reverse shell returned
09:30 - Talking about hidepid=2 is set, so …

app code default file gobuster hackthebox introduction manager message nmap password php shell soccer source code start the web tiny upload web web app website