All right, you guys, so in this post we're going to talk about at the box what it is and how you can
get started.
So check the box.
What it is is basically an online penetration testing platform.
It's a lab that allows security practitioners, you know, bug bounty hunters, new and aspiring penetration
testers and, you know, even red team operators to, you know, get the hands on skills they need to
improve their tradecraft.
So to get started, we can just type in, hack the box and will get started.
So let me show you something here.
First, hack the box is a dash.
You page, you notice it's dot dash you.
It is not a dot com.
So if you hit the dotcom, you won't go to the right page.
Just want to point that out for you.
All right.
So we're going to go ahead and go to the box and the first thing is going to do is going to say, hey,
you know, start hacking.
Right, except the cookies.
How do you do that?
Well, you need to join.
Now, the interesting thing about Hack the box is if I click joined now in the upper right corner,
you know, I'm not just going to join this website.
Like, I would join any other website you have to hack into hack the box to join.
Hack the box.
All right.
So, you know, if you don't want to see how to do that, you know, you can go ahead and stop this
video and go to the next lecture.
However, if you if you're you know, if you're really interested and you want to know how to do that
so you can get started with your VIP account, you know, continue to follow along.
So there's an invite challenge, right.
This is high.
Feel free to hack your way in.
You know, you need to get this invite code and you can click here if you wanted a hint of some kind.
So how are we going to do this?
You know, usually when we get an endpoint or we get a Web page that we want to attempt to compromise.
So the first thing we're going to do is view source.
So I'm going to press control.
You look at the source and I can't make out what this is.
So control w let's close it out and let's just get some hints.
Check the console.
Right.
So we're using Google Chrome, although any major Web browser has this capability, you need to open
dev tools so you can.
Right.
Click and go to inspect your shift eye or an upper right corner.
You can just go down to more tools and go to developer tools.
Right.
Matley, you can see on a console some ASCII art, the first step of the challenge, keep calm and hack
this box.
This page contains an interesting JavaScript file.
See if you can find it.
And there's some arrows down here, right.
So how do we find these JavaScript files?
Well, you could go to elements and you could, you know, expand all these skip tags and, you know,
try to make sense of this.
The easiest thing to do is to click on sources and then go in the jazz folder.
Right.
That's where the JavaScript included fonts or where fonts are included successes where cascading style
sheets are included.
So in the James folder, we see two James files and the one we are interested in it stands to reason
is ENVI API Dustmen.
This has something to do with the invitation API application programming interface and it's minimized
or minified, which means that the JavaScript file is compressed so that it can load optimally.
So here it says this JavaScript code looks strange.
Is it obfuscated and it can be kind of hard to read.
So what we're going to do is in a bottom left corner here, we're going to click prettify the print
and this expands.
It makes a little bit easier to read as you see down here.
You might notice something interesting, right?
Make ENVI code.
What is making bytecode?
Well, it's a function, right.
So let's see if we can call that function.
If I go to the console and I type make and before I can finish, you see a ghost script of what I should
type in and write code, write off, I just type in my code like this and I present her.
I'm going to get like a response that includes this endpoint API invite how to generate dot com.
So you might think, oh, this is easy.
Copy, link address.
And you can see this something went wrong, right?
Clearly, something went wrong.
So let's go back.
Let's think about this.
Right.
This is a function and almost every function includes parentheses.
Right?
So it's typed the same thing, but with parentheses in the console
to a response back.
But the data's encrypted.
We get the string.
Interesting.
Let's go and see if we can decrypt it, select right, click copy.
And you see it says base64, it's it's not actually encrypted, it's encoded.
And we have a couple of options.
First, we can use windows built in windows, tools to base64 decoded, or we could use cyber sheft.
Let's try Windows first.
So I'm going to go to the command prompt.
There's a tool concert detail that should allow us to do this so we do a certain tool to help
us do for like questionmark.
Too much.
So it's pipe that defined, string case insensitive and search for bass and string.
It's kind of like rap, but it's just when the wind is equivalent, we can decode it basically for encoded
file.
Right now it has to be a file.
So let's create a file first notepad be 64 again.
Do you want to create a new file?
Yes, I do.
Pasting the contents of F that's to save all that to exit and then let's verify that our string is there.
It is now we can do certainly till dash decode and we can put in the file and the file complete successfully.
Pretty cool.
So we do type out that text.
We have the decoded string and here's what you need to make a post request to this endpoint.
So let's do it.
How do we do that?
Well, you might think.
All right, I'm going to put that here.
Right.
Break that out.
Enter.
And again, something went wrong.
If you look at the network request for this and the response, as you see, was actually a get request.
Right?
That's not what we want.
We want to post how do we send a post request?
Well, there's a couple of ways we can do it.
We can do it in windows pretty easily.
So there's a tool called Kerl.
They can see we are using the Windows version of Kerl so we can use Kerl to make this request.
So if I do Kerl let's see if we do help.
We're just going to pipe this response to find strewing, again, case sensitive search for request
immediately.
We can see if we do X and then the request type we can specify the request to use.
Let's do Colonel.
That's ex post request.
You want to send it here?
Control left.
Put me to the beginning of the string and then right clicking pasó.
Then I move.
I'm going to remove invite then I'm going to hit enter and look we got the clue back in this code.
Looks like it's also base64 encoded so I just selected and right.
Click to copy to my clipboard then we can decode this.
Now I'm going to show you a different way to decode it using cyber stuff.
So if you just do cyber chef, go to the first link.
You'll see a couple of options here.
Let me just kind of break it down for you.
So this side over here are the all the operations, right?
So you can do stuff like you can encode the basics before you can decode from it.
You can use hex values.
There's a lot of different things you can do here.
Right.
Let's see here.
I mean, trace this, then you have recipes and this is where you put your type of operation you want.
So you just drag from from base64 into this section.
You click back and then you put your input here.
Right.
And then the result is going to be shown here.
Let me show you exactly what this looks like.
All right.
So from base64 Jova Paste, and then we have a code.
I don't even have to click back that time.
Sometimes you don't have to it.
By the way, if I want to make this look really cool, you can go to options and change the theme from
classic to dark.
And that looks kind of neat, right?
I'm all about dark themes anyway.
So you can also, by the way, down with this to your computer so you don't have to send potentially
sensitive strings to the Internet.
You can actually just use this Web page on your local machine.
All right.
So then we put in the invite code setup.
Congratulations.
We've done it.
So this is where we put it in our account information.
Oops, that should have gone on here and then you put in your password, except I'm not a robot when
you register.
Now I've already registered.
So in the next election, I'm going to show you what it looks like once you're signed into.