Infinite Logins
Infinite Logins
  • 75
  • 825 987
Multi Endpoint Race Conditions Lab | PortSwigger Web Academy
This is the third video in a series of videos that go over the Portswigger Race Condition labs. In this video, we show how a race condition can lead to unexpected behavior during checkout flows of eCommerce web applications.
Part 1: ua-cam.com/video/Zp04Gn7lsIU/v-deo.html
Part 2: ua-cam.com/video/y-lqIXXSmqk/v-deo.html
Part 3: ua-cam.com/video/EdILu6WgqtQ/v-deo.html
00:00 - Intro
00:35 - Understanding the Application
05:00 - Establishing Baseline
08:10 - Testing Race Condition
13:00 - Checking for MORE Race Conditions
14:30 - Solving the Lab
15:55 - Conclusion
👇 SUBSCRIBE TO INFINITELOGINS UA-cam CHANNEL NOW 👇
ua-cam.com/users/infinitelogins
___________________________________________
Social Media:
Website: infinitelogins.com/
Twitter: infinitelogins
Twitch: www.twitch.tv/infinitelogins
___________________________________________
Donations and Support:
Like my content? Please consider supporting me on Patreon:
www.patreon.com/infinitelogins
Purchase a VPN Using my Affiliate Link
www.privateinternetaccess.com/pages/buy-vpn/infinitelogins
___________________________________________
Tags: #portswigger #pentesting #websecurity
Переглядів: 1 024

Відео

Bypassing Rate Limits Race Conditions Lab | PortSwigger Web Academy
Переглядів 1,4 тис.10 місяців тому
This is the second video in a series of videos that go over the Portswigger Race Condition labs. In this video, we show how a race condition can lead to bypassing rate limits in web applications. Part 1: ua-cam.com/video/Zp04Gn7lsIU/v-deo.html Part 2: ua-cam.com/video/y-lqIXXSmqk/v-deo.html Part 3: ua-cam.com/video/EdILu6WgqtQ/v-deo.html 00:00 - Intro 00:35 - Understanding the Application 03:45...
Limit Overrun Race Conditions Lab | PortSwigger Web Academy
Переглядів 2,2 тис.10 місяців тому
In this video, we go over the Limit Overrun Race Conditions lab by Portswigger Web Academy to learn how to find and leverage race conditions within Web Applications. Part 1: ua-cam.com/video/Zp04Gn7lsIU/v-deo.html Part 2: ua-cam.com/video/y-lqIXXSmqk/v-deo.html Part 3: ua-cam.com/video/EdILu6WgqtQ/v-deo.html 00:00 - Intro 01:35 - Understanding the Application 04:50 - Initial Tests 05:40 - Tab G...
Browser in the Browser (BITB) Phishing Technique - Created by mr.d0x
Переглядів 48 тис.2 роки тому
As cybersecurity professionals, we constantly educate users to review the URL before interacting with a website. This Browser in the Browser technique created by mr.d0x is one way that this advice can be abused and used against us. Disclaimer: This content is intended to be consumed by cyber security professionals, ethical hackers, and penetration testers. Any attacks performed in this video sh...
Why IT Shouldn't Use Domain Admin Accounts on Laptops and Workstations
Переглядів 4,1 тис.2 роки тому
I've found myself talking with people about the dangers of administrating workstations with Domain Admin accounts recently and decided to demonstrate one possible attack scenario here. In this video, I show how simply signing into a compromised system as a Domain Admin can lead to a full compromise of the Active Directory environment. Disclaimer: This content is intended to be consumed by cyber...
Visualizing Nmap Output Using Webmap | Automate Report Writing
Переглядів 4,3 тис.2 роки тому
It's often that you find yourself looking at a mountain of Nmap output when scanning a large range of hosts. Using a tool like Webmap can help keep you organize as you sort through this output and help you automate the report writing process. Disclaimer: This content is intended to be consumed by cyber security professionals, ethical hackers, and penetration testers. Any attacks performed in th...
Your Notepad++ Drafts Aren't as Secret as You Think...
Переглядів 7292 роки тому
Follow along and I’ll show you how local administrator access to a machine could be all an attacker needs to gain access to your “secret” Notepad drafts. Disclaimer: This content is intended to be consumed by cyber security professionals, ethical hackers, and penetration testers. Any attacks performed in this video should only be performed in environments that you control or have explicit permi...
How to Capture Net-NTLMv2 Hashes Using DHCP w/ Responder
Переглядів 15 тис.2 роки тому
We've discussed how to use Responder to capture Net-NTLMv2 hashes using protocols like LLMNR before, but the latest version now allows for DHCP poisoning, a phenomenally effective method. Disclaimer: This content is intended to be consumed by cyber security professionals, ethical hackers, and penetration testers. Any attacks performed in this video should only be performed in environments that ...
New Razer Bug Allows Local Privilege Escalation to SYSTEM
Переглядів 2,4 тис.2 роки тому
Through a local privilege escalation bug in Razer, it is possible to escalate privileges from a standard user to administrator using a simple mouse or keyboard. Disclaimer: This content is intended to be consumed by cyber security professionals, ethical hackers, and penetration testers. Any attacks performed in this video should only be performed in environments that you control or have explici...
TCM Security's PNPT Exam Review (Formerly CPEH)
Переглядів 12 тис.2 роки тому
I took the PNPT certification exam in July of 2021 and passed on my first attempt. This video is an overview of the exam so you can learn what to expect going into it, and hopefully better prepare yourself for success. 👇 SUBSCRIBE TO INFINITELOGINS UA-cam CHANNEL NOW 👇 ua-cam.com/users/infinitelogins Blog post mentioned in video: infinitelogins.com/2021/07/18/practical-network-penetration-teste...
Abusing HiveNightmare (SeriousSam) LPE - Escalating to SYSTEM | CVE-2021-36934
Переглядів 14 тис.2 роки тому
In this video, I demonstrate how the HiveNightmare vulnerability works in order to escalate privileges from a Standard user to an Administrator or SYSTEM-level access within a Windows machine. At the end, the video discusses how to protect yourself against this vulnerability through a mitigation strategy. 👇 SUBSCRIBE TO INFINITELOGINS UA-cam CHANNEL NOW 👇 ua-cam.com/users/infinitelogins Please ...
Abusing PrintNightmare RCE (CVE-2021-1675) - Dump Hashes on Domain Controllers
Переглядів 6 тис.2 роки тому
The exploit abuses the Print Spooler in Windows to load malicious DLL files. This video shows how this exploit is being used as a Remote Code Execution vulnerability, along with how to mitigate against these attacks. Check out the previous video to see how this same vulnerability can be used for Local Privilege Escalation. Disclaimer: This content is intended to be consumed by cyber security pr...
Abusing PrintNightmare (CVE-2021-1675) - Local Privilege Escalation
Переглядів 6 тис.2 роки тому
The exploit abuses the Print Spooler in Windows to load malicious DLL files. This video shows how this exploit is being used as a local privilege escalation, along with how to mitigate against these attacks. Check out the next video to see how this same vulnerability can be used for Remote Code Execution against a Domain Controller. Disclaimer: This content is intended to be consumed by cyber s...
Microsoft Teams Messages Aren't as Secret as You Think...
Переглядів 1,6 тис.3 роки тому
Follow along and I’ll show you how local administrator access to a machine could be all an attacker needs to gain access to your “secret” Microsoft Teams chats. 👇 SUBSCRIBE TO INFINITELOGINS UA-cam CHANNEL NOW 👇 ua-cam.com/users/infinitelogins Disclaimer: This content is intended to be consumed by cyber security professionals, ethical hackers, and penetration testers. Any attacks performed in t...
Creating Effective Custom Wordlists Using Hashcat Rules - Password Security
Переглядів 14 тис.3 роки тому
If you've been following the channel, then you should know all about password attacks by this point. In this video, I show how you can take your password cracking up a notch by creating effective custom wordlists using Hashcat rules. Disclaimer: This content is intended to be consumed by cyber security professionals, ethical hackers, and penetration testers. Any attacks performed in this video ...
Auditing Active Directory - Cracking NTLM Hashes With Hashcat
Переглядів 14 тис.3 роки тому
Auditing Active Directory - Cracking NTLM Hashes With Hashcat
Auditing Windows Active Directory for Weak Passwords - Dumping Hashes From Domain Controller
Переглядів 9 тис.3 роки тому
Auditing Windows Active Directory for Weak Passwords - Dumping Hashes From Domain Controller
Chaining Cross Site Request Forgery (CSRF) to Gain Cross Site Scripting (XSS) | Part 2
Переглядів 9133 роки тому
Chaining Cross Site Request Forgery (CSRF) to Gain Cross Site Scripting (XSS) | Part 2
Chaining Cross Site Request Forgery (CSRF) to Gain Cross Site Scripting (XSS) | Part 1
Переглядів 1,2 тис.3 роки тому
Chaining Cross Site Request Forgery (CSRF) to Gain Cross Site Scripting (XSS) | Part 1
Live Interview with Codingo! Working at BugCrowd, Competing with YouTube, and Getting Into Ethical..
Переглядів 3483 роки тому
Live Interview with Codingo! Working at BugCrowd, Competing with UA-cam, and Getting Into Ethical..
How Hackers Use Reflected Cross Site Scripting (XSS) to Steal Session Cookies, and how to mitigate.
Переглядів 6 тис.3 роки тому
How Hackers Use Reflected Cross Site Scripting (XSS) to Steal Session Cookies, and how to mitigate.
How Hackers Use Stored Cross Site Scripting (XSS) to Steal Session Cookies (and how to mitigate it)
Переглядів 40 тис.3 роки тому
How Hackers Use Stored Cross Site Scripting (XSS) to Steal Session Cookies (and how to mitigate it)
Interactive Pentest Ep1 - You're in Control! | Legacy on Hack The Box
Переглядів 5 тис.3 роки тому
Interactive Pentest Ep1 - You're in Control! | Legacy on Hack The Box
Beware Craigslist Scams Pt 1: Google Voice Verification
Переглядів 2,7 тис.3 роки тому
Beware Craigslist Scams Pt 1: Google Voice Verification
How To Split Unix Terminals and More | Tmux Basics
Переглядів 1,1 тис.3 роки тому
How To Split Unix Terminals and More | Tmux Basics
Attacking Active Directory | Capturing Hashes via File Shares & .LNK Files
Переглядів 2,2 тис.3 роки тому
Attacking Active Directory | Capturing Hashes via File Shares & .LNK Files
SolarWinds Sunburst Detection and Response to Indicators of Compromise
Переглядів 7233 роки тому
SolarWinds Sunburst Detection and Response to Indicators of Compromise
How To Crack Encrypted 7-Zip Archives
Переглядів 110 тис.3 роки тому
How To Crack Encrypted 7-Zip Archives
How To Remove LLMNR and NBT-NS From Your Active Directory Environment
Переглядів 3,9 тис.3 роки тому
How To Remove LLMNR and NBT-NS From Your Active Directory Environment
What Type of Pentest Assessments Are There?
Переглядів 1833 роки тому
What Type of Pentest Assessments Are There?

КОМЕНТАРІ

  • @itsme7570
    @itsme7570 День тому

    IPPs3c is a Beast

  • @itsme7570
    @itsme7570 День тому

    Won't find this in the wild very often

  • @marlo6846
    @marlo6846 3 дні тому

    Thank you!

  • @youtraders
    @youtraders 22 дні тому

    tanks verymuch

  • @stormdriftwood3574
    @stormdriftwood3574 26 днів тому

    Very nice video!!! Thanks.

  • @jimgrayson4828
    @jimgrayson4828 29 днів тому

    Keep up the good work kiddo

  • @wibuiscutcho
    @wibuiscutcho Місяць тому

    Can you hack the login of a website to test the power of hydra tool on termux? I have never seen anyone use hydra tool on their phone and successfully get a password to log in to a website ??

  • @bathtoaster335
    @bathtoaster335 Місяць тому

    Hi mate, been trying to do this for a uni assignment, and I have been getting some errors trying this on Windows 7, could you please recommend a link or method to get an ISO for the Win10 virtual machine like yours, and also any set up or adjustments that need to be made? Thank you heaps

  • @Servietsky_
    @Servietsky_ Місяць тому

    U the goat, one more sub

  • @ImDubbleYou
    @ImDubbleYou Місяць тому

    The best practical reasoning and demonstration I've found for locking down domain admins

  • @Northcliffevassenger
    @Northcliffevassenger Місяць тому

    Thanks for demostrating the power of linux/ Active Directory vulnerabilities are one of the most common pitfalls in the actual networking envrionment.

  • @matthewstott3493
    @matthewstott3493 2 місяці тому

    The only trouble with the webapp Docker project is that it hasn't been updated in 5 years and it was a fork of another project that disappeared.

  • @Sandyfaceroll
    @Sandyfaceroll 2 місяці тому

    does this still work in 2024?

  • @JonnyGators
    @JonnyGators 2 місяці тому

    As soon as you mention zip2john, this video becomes COMPLETELY USELESS to anyone that isn't familiar with this tool, or knows anything about how to get it or install it. I've spent the past hour searching high and low trying to find this tool. Nothing works! How about providing the necessary information to make this video actually useful to those of us that are coming in without that essential piece of knowledge? Thanks.

  • @androiddoctor4897
    @androiddoctor4897 2 місяці тому

    Is this getting done due to having reapter tab group feature in burp ? Any other ways to achieve the samething...

  • @bathtoaster335
    @bathtoaster335 2 місяці тому

    legendary work

  • @purplepineapple4293
    @purplepineapple4293 2 місяці тому

    Oh boy oh boy, where do I even begin? Let me tell you, Infinite Logins is an absolute maestro when it comes to hacking skills. It's like witnessing digital wizardry in action! From cracking intricate codes to navigating through complex security layers, Infinite Logins makes hacking seem like an art form. Their expertise is simply mind-blowing. They glide through firewalls like a phantom, effortlessly breaching barriers that would leave most hackers scratching their heads. It's as if they have an innate intuition for understanding the deepest recesses of computer systems, unraveling their secrets with finesse and precision. But it's not just about technical prowess; it's about the creativity and innovation that Infinite Logins brings to the table. Each hack is a masterpiece, meticulously crafted with ingenuity and flair. They think outside the box, employing unconventional methods and strategies that keep their adversaries on their toes. Infinite Logins is not just a hacker; they're a force to be reckoned with, a digital virtuoso whose skills are matched only by their passion for exploration and discovery. In a world where cybersecurity is paramount, having someone like Infinite Logins on your side is nothing short of invaluable. So here's to Infinite Logins, the epitome of hacking brilliance. May their skills continue to dazzle and inspire, setting new standards for excellence in the ever-evolving landscape of cybersecurity.

  • @rocstarnol
    @rocstarnol 2 місяці тому

    how can you setup a login page to practice

  • @ananta8998
    @ananta8998 2 місяці тому

    thankyou so much.. this is very helpful ..great explanation🤩🤩

  • @sikandarsubhani6238
    @sikandarsubhani6238 2 місяці тому

    I can't locate 7zjohn

  • @CoderLoAnt
    @CoderLoAnt 2 місяці тому

    I can't find pDriverPath .What's wrong? it've worked to Bind Ok then it did not found PDriverPath

  • @user-zu4ft8yw9e
    @user-zu4ft8yw9e 2 місяці тому

    The stages involved in resolving issues related to CVE-2021-1675 include: 1. Identification: Discovering and cataloging the vulnerability through methods like vulnerability scanning or manual assessments. 2. Reporting and Metrics: Generating reports and metrics to track the effectiveness of vulnerability management efforts. 3. Responsibilities and Roles: Clearly defining responsibilities and roles for personnel involved in the vulnerability management process.

  • @D.von.N
    @D.von.N 2 місяці тому

    I an a lay person. You talk about one cookie. Session cookie: is it only for one login into a particular website or is it all session cookies that exist in the browser at the given time?

  • @shubhamtyagi4071
    @shubhamtyagi4071 2 місяці тому

    <script>alert("hacked")</script>

  • @shubhamtyagi4071
    @shubhamtyagi4071 2 місяці тому

    <script>alert("hacked"")</script>

  • @shubhamtyagi4071
    @shubhamtyagi4071 2 місяці тому

    123<>"

  • @cleety4530
    @cleety4530 2 місяці тому

    very good video. Question. Are you using NAT on vms? doesn't look like host only. Having trouble capturing hashes but responder does run. probably a conf issue.

  • @ColePatterson-mw2gy
    @ColePatterson-mw2gy 2 місяці тому

    Skipped multiple steps

  • @youssefblt9839
    @youssefblt9839 2 місяці тому

    thanks alot i have read the blog and it was more than enaogh to forge an attack on my lab of corse but i have decided to watch the vid for the extras sauce and u were magnifisante please excuse my english and thanks

  • @DkReaction27
    @DkReaction27 3 місяці тому

    Any undetectable paypal phishing tool fr termux pls my link is detectable

  • @potatofu5611
    @potatofu5611 3 місяці тому

    thanks! i didn't know this was possible in repeater, i did something similar but using an extension called turbo intruder

  • @neverlookbackwilly
    @neverlookbackwilly 3 місяці тому

    3:33 that was exactly the purpose of my click, ngl using it for evil is another thing, but I wanted to know how to do it...

  • @pick_pick_pick
    @pick_pick_pick 3 місяці тому

    love it

  • @adamgwozdz7411
    @adamgwozdz7411 3 місяці тому

    Thank you so much, you made my day

  • @SING266
    @SING266 3 місяці тому

    Hi when did you get user and pass?

  • @a_f_l_a_hknr271
    @a_f_l_a_hknr271 4 місяці тому

    damn man i cant get it iam stuck , by the way your videos are litt

  • @A7M4DZX
    @A7M4DZX 4 місяці тому

    Bro learn me pls how to get up address ??

  • @waelmas
    @waelmas 4 місяці тому

    How To: Evilginx + BITB | Browser In The Browser without s in 2024 ua-cam.com/video/luJjxpEwVHI/v-deo.html Just released this new version that makes this work with Evilginx to bypass MFA. This version does not use any s, meaning it completely bypasses framebusters 🤞 (Not trying to self promote under this video, but saw a lot of traffic coming from it to my video and thought I’d leave this comment that might be helpful)

  • @user-id7tw9dq3o
    @user-id7tw9dq3o 4 місяці тому

    How to use the -x command pls help

  • @MohammedSalah2405
    @MohammedSalah2405 4 місяці тому

    My facebook page has been stolen and the hacker is posting porno on it. How can I restore it? I reported many times to FB in vain for sure. MB cuz my name is Mohamed?

  • @user-on1vw6lm9o
    @user-on1vw6lm9o 4 місяці тому

    I have followed your video and everything works perfect and I was able to actually solve the lab and wanna thank you for the good work. I have a question, why does burp quits when I load my own personal payload to the clipboard? Is there a limit on the size of the file?

  • @nouaimmebarki5669
    @nouaimmebarki5669 5 місяців тому

    great explanation, thank you

  • @N0RT0X
    @N0RT0X 5 місяців тому

    Really helpful!

  • @user-bi3dw1oe3p
    @user-bi3dw1oe3p 5 місяців тому

    Good work, but I used eSofttools 7z Password Recovery Software and its worked very well without any file harming.

  • @pd3331
    @pd3331 5 місяців тому

    Thanks, this worked for me. My password was very simple so it was able to get it.

  • @ronburgundy1033
    @ronburgundy1033 5 місяців тому

    How do we find the domain controller name

  • @imbissbudenbronko_DEU
    @imbissbudenbronko_DEU 5 місяців тому

    Hey. How i get this Search Function beginning at 03:57 and marked in orange?

  • @binarytech8457
    @binarytech8457 5 місяців тому

    Very interesting, thx for sharing. So basically the only requirement for this attack is that the attackers machine has to be on the same network as DHCP server or clients net? It would be also nice if you can share how to mitigate this.

  • @TrasherBiner
    @TrasherBiner 5 місяців тому

    You keep typing "clear" to clear the screen. You know you can press Ctrl+L right? even in the middle of typing the command line. Just a friendly PSA. It's just it's painful to see you type "clear" every single time, when you seem "linux fluent" otherwise...