Uploaded September 2025 | Updated September 2026, 3 weeks ago
00:00 - Introduction
01:00 - Start of nmap
02:30 - Discovering that Laravel is running based upon 404 page (or cookie)
04:40 - Running GoBuster, adding 403 to the ignore list of codes and discovering /upload
05:40 - Laravel running in DEBUG mode, so the error page gives verbose info. Searching for CVE's for Laravel 11.30.0
07:55 - CVE-2024-52301, changing the Laravel environment with argument pollution
09:30 - Discovering we can bypass auth by setting environment to preprod
14:30 - Exploiting another Laravel CVE-2025-27515 to bypass the extension blacklist
22:45 - Got a shell on the box, dumping database
24:00 - Discovering a GPG Encrypted file, using keys on the box to decrypt it
27:30 - Sudo lets us keep the environment BASH_ENV which lets us set the bash environment to a script and privesc
30:00 - Beyond root, showing disabling debug mode on application and nginx config
00:00 - Introduction
01:00 - Start of nmap
02:30 - Discovering that Laravel is running based upon 404 page (or cookie)
04:40 - Running GoBuster, adding 403 to the ignore list of codes and discovering /upload
05:40 - Laravel running in DEBUG mode, so the error page gives verbose info. Searching for CVE's for Laravel 11.30.0
07:55 - CVE-2024-52301, changing the Laravel environment with argument pollution
09:30 - Discovering we can bypass auth by setting environment to preprod
14:30 - Exploiting another Laravel CVE-2025-27515 to bypass the extension blacklist
22:45 - Got a shell on the box, dumping database
24:00 - Discovering a GPG Encrypted file, using keys on the box to decrypt it
27:30 - Sudo lets us keep the environment BASH_ENV which lets us set the bash environment to a script and privesc
30:00 - Beyond root, showing disabling debug mode on application and nginx config
