HackTheBox - UpDown

00:00 - Intro
01:00 - Start of nmap
01:30 - Testing the webhook, examining the request the server makes
05:30 - Trying other URL Wrappers to see how the application behaves
08:10 - Finding the .git sub directory, running git-dumper to extract source code
10:55 - Finding and explaining the LFI Vulnerability
12:10 - Attempting to use the php filter to extract source code, does not work, turns out there's another website
14:00 - Discovering there is a special header …

application code directory extract filter git git-dumper hackthebox lfi lfi vulnerability nmap php request server source code start testing url vulnerability webhook website work