Uploaded August 2026 | Updated September 2026, 2 weeks ago
00:00 - Introduction
01:00 - Start of nmap
03:00 - Creating an account on the main domain and discovering it doesn't create one on vote
05:30 - Discovering a SQL Injection when suggesting URL's on the vote application, converting it to Union Injection and showing SQLMap
10:15 - Union injection working, getting the payload over to SQLMAP so we can have it dump the database while we look at other things
15:30 - Going back to the Skin Suggestor, discovering XSS
17:50 - Having the XSS Send us back the page the victim is on, discovering a debug page is linked which contains PHPINFO
23:15 - The PHPINFO output reflects the PHP Cookie, creating a CSRF Payload to have the victim navigate to the PHPINFO page and send us the output to steal their cookies even thoe they are marked HTTPONLY
28:15 - Discovering SSTI, this is PHP so using a PHP TWIG Payload to get RCE, some commands fail discovering it is apparmor
35:15 - Failing to get a reverse shell for a while
41:08 - Using MySQL Dump to dump the database, the SQL injection didn't get this because its a different DB
45:50 - Shell returned as Cobblestone
51:00 - Discovering Cobbler is running, forward the post back to us, use XMLRPC to get RCE (a 2014 GitHub issue)
54:20 - Having Claude look at the issue and try to make a POC while we poke at it manually
58:48 - Proving we can bypass auth with -1 as the password, and getting shell
00:00 - Introduction
01:00 - Start of nmap
03:00 - Creating an account on the main domain and discovering it doesn't create one on vote
05:30 - Discovering a SQL Injection when suggesting URL's on the vote application, converting it to Union Injection and showing SQLMap
10:15 - Union injection working, getting the payload over to SQLMAP so we can have it dump the database while we look at other things
15:30 - Going back to the Skin Suggestor, discovering XSS
17:50 - Having the XSS Send us back the page the victim is on, discovering a debug page is linked which contains PHPINFO
23:15 - The PHPINFO output reflects the PHP Cookie, creating a CSRF Payload to have the victim navigate to the PHPINFO page and send us the output to steal their cookies even thoe they are marked HTTPONLY
28:15 - Discovering SSTI, this is PHP so using a PHP TWIG Payload to get RCE, some commands fail discovering it is apparmor
35:15 - Failing to get a reverse shell for a while
41:08 - Using MySQL Dump to dump the database, the SQL injection didn't get this because its a different DB
45:50 - Shell returned as Cobblestone
51:00 - Discovering Cobbler is running, forward the post back to us, use XMLRPC to get RCE (a 2014 GitHub issue)
54:20 - Having Claude look at the issue and try to make a POC while we poke at it manually
58:48 - Proving we can bypass auth with -1 as the password, and getting shell
