XSS in PDF.js (CVE-2024-4367) - "Upload" [Akasec CTF 2024]

Опубликовано: 01 Октябрь 2024
на канале: CryptoCat

3,438

186

Video walkthrough for the "Upload" web challenge from Akasec CTF 2024. The challenge involved server-side XSS (dynamic PDF) using a recent exploit (CVE-2024-4367) and SSRF! Write-ups/tutorials aimed at beginners - Hope you enjoy 🙂 #Akasec #CTF #CaptureTheFlag #Pentesting #OffSec #WebSec #AppSec

Write-ups: https://crypto-cat.gitbook.io/ctf-wri...

↢Social Media↣
Twitter:   / _cryptocat
GitHub: https://github.com/Crypto-Cat/CTF
GitBook: https://crypto-cat.gitbook.io
HackTheBox: https://app.hackthebox.eu/profile/11897
LinkedIn:   / cryptocat
Reddit:   / _cryptocat23
YouTube:    / cryptocat23
Twitch:   / cryptocat23

↢Akasec CTF 2024↣
https://ctf.akasec.club
https://ctftime.org/event/2222
  / discord
  / akasec_1337
  / akasec-1337

↢Resources↣
Ghidra: https://ghidra-sre.org/CheatSheet.html
Volatility: https://github.com/volatilityfoundati...
PwnTools: https://github.com/Gallopsled/pwntool...
CyberChef: https://gchq.github.io/CyberChef
DCode: https://www.dcode.fr/en
HackTricks: https://book.hacktricks.xyz/pentestin...
CTF Tools: https://github.com/apsdehal/awesome-ctf
Forensics: https://cugu.github.io/awesome-forensics
Decompile Code: https://www.decompiler.com
Run Code: https://tio.run

↢Chapters↣
0:00 Start
0:55 Source code review
4:39 XSS (CVE-2024-4367)
10:11 SSRF
15:29 End