Security Videos

HackTheBox - VariaType

00:00 - Introduction 01:00 - Start of nmap 02:10 - Finding some CVE's in FontTools, but doing more recon on the site before we dive too deep 06:30 - Enumerating the website is flask based upon error message (cookie works too) 09:20 - Trying to create an error message which could leak information about the server like its local path 11:30 - Taking a look at portal.variatype.htb which shows it is PHP 13:50 - Gobuster found a .git, running git-dumper to get the source 15:30 - Finding a File Disclosure in the PHP App because the ../ removal was not recursive 20:30 - Updating the FontTools script to put a reverse shell in, then using it to upload a php reverse shell to the portal 22:00 - Reverse shell returned 22:30 - Looking at the sudoers file, we can't read it but the metadata is a treasure trove of information. Looking at timestamps, doing some filtering getting nothing 26:30 - Using docker to spin up a debian image quickly, looking at the size of the default sudoers file and then comparing it to the box to see it has likely been modified 28:00 - Using find to look for files owned by steve, finding a backup script. It uses FontForge which has a CVE. We can put a malicious archive file and get RCE 37:00 - Shell returned as Steve 39:00 - Looking at the validator python script, first thought with symlinks won't work because we don't own the plugin directory 41:30 - Finding a CVE within SetupTools, using it to write an SSH Key

The Korvath Incident: A macOS Forensics Challenge

🔥 Announcing a new challenge for Investigating macOS Endpoints! This comprehensive hands-on macOS forensics scenario accompanies our in-depth training and allows students to put their investigative skills to the test in a realistic case.

HackTheBox - Facts

00:00 - Introduction 00:55 - Start of nmap 02:30 - Discovering it is Camaleon CMS based upon the theme url 04:00 - Looking at the cookie to see it is likely a RAILS App 06:00 - Discovering /admin, enumerating valid usernames by how long a login takes 09:40 - Playing with Mass Assignment spots in the application, failing the first few 13:10 - Exploiting mass assignment from the password reset and setting role to admin 16:30 - Discovering AWS Information in the admin panel, setting upthe AWS CLI to use this endpoint then download a ssh key from S3 21:30 - Cracking SSHNG$6 with John because Hashcat doesn't have this yet 25:15 - Our user can run facter with sudo, looking at the GTFOBin and getting code execution 29:20 - Beyond Root: Exploiting CVE-2024-46987, which is a File Disclosure

HackTheBox - Interpreter

00:00 - Introduction 00:46 - Start of nmap 05:30 - Looking at CVE-2023-43208, Exploiting Mirth Connect 4.4.0 07:45 - Extracting the payload from python so we can send it via the API, getting ping to work to verify RCE 09:22 - Getting a reverse shell working in one-shot, weird oddity due to Java Deserialization 13:10 - Reverse shell returned, dumping the database 16:00 - Looking at Mirth Connect Source Code to see how the passwords are stored, then getting the passwords in a format hashcat likes to crack 27:00 - SSH as Sedric, discovering an app listening on port 54321, doing some weird eval 36:20 - Getting a payload to the custom webserver, troubleshooting XML Schema validation 40:20 - Confirming code execution then building a payload to get a shell

HackTheBox - MonitorsFour

00:00 - Introduction 00:57 - Start of nmap 03:20 - Looking at the webpage doing basic enumeration 05:30 - Talking about Orange Tsai Worst Fit -- Doesn't get us anything but a path i went down first 09:50 - Discovering the /user endpoint, fuzzing the token parameter discovering type juggling, cracking hashes 14:40 - Logging into the application, which seems like an odd static page 18:00 - Discovering the Cacti Domain, Logging in and showing we can enumerate if a user is valid or not by a timing attack 23:50 - Exploting CVE-2025-24367 , which lets us create php files on the target 28:40 - Creating the payload to drop the file to get RCE 36:00 - Shell returned. 38:10 - Using bash to be a basic port scanner, then dumping the database 45:00 - Manually exploiting CVE-2025-9074, talking to Docker over HTTP to create a container that mounts the host operating system in a container then reading the flag 55:00 - Getting code execution on the host by looking at scheduled tasks and changing a powershell script that runs every 3 minutes

Top 3 things you should know about Windows

Black Discord Malware: XWorm

I stumbled across a Malware named "Black Discord", turned out to be an interesting XWorm trojan that can act as both infostealer and ransomware.

HackTheBox - Pterodactyl

01:05 - Start of nmap 04:00 - Using ffuf to find the panel subdomain, which shows pterodactyl.htb 06:30 - Discovering the version of pterodactyl running by looking at the GitHub Releases and looking for the js bundle name 10:00 - Searching CVE's finding the Pterodactyl CVE-2025-49132 POC, and running an exploit script 17:00 - Finding PHP PEAR directory which allows our exploit to run 19:05 - Looking at the source code, and running through the exploit manually 36:00 - Shell on the box dump the database, crack a cred to get an account 43:40 - Looking at CVE-2025-6018 which lets us impersonate a physical logged in user in policy kit 46:25 - Exploiting CVE-2025-6019 which is a CVE in UDISKS, when it does the resize it mounts a partition without the NOSUID flag 52:55 - Starting a script to execute bash in our malicious mount, then telling udisks to resize it and getting a shell

HackTheBox - Overwatch

00:00 - Introduction 00:45 - Start of nmap 03:00 - Null Authentication lets us list open shares 05:30 - Using SMBClient and downloading the overwatch binary and config from the fileshare 08:40 - Using ilSpycmd to decompile the dotnet from Linux 10:04 - Looking at the overwatch source, which is a WCF (Windows Communication Foundation) Binary 14:00 - Taking nmap allports output, doing some bashful to get a list of open ports to do our normal nmap against the open ports 17:40 - Finding MSSQL on port 6520, we can login. The Enum_Links shows an SQL Server, it hangs and says the host SQL07 doesn't exist 21:45 - Using BloodyAD to show AD Attributes we can write to, discover we can create DNS Entries, then creating a DNS Entry for SQL07 to point back to us and then getting the SQLMGMT user credentials 25:00 - Looking at the WCF Endpoint, examining the WSDL and explaining it a little bit 26:30 - Executing endpoints in the WCF Endpoint from PowerShell with New-WebServiceProxy and getting RCE on the server 33:00 - Showing how we could have enumerated services from our first shell

Hunting Copy Fail: 732 Bytes to Root

In this episode, we'll look at how Copy Fail (CVE-2026-31431) works and highlight key forensic detection opportunities. *** If you enjoy this video, please consider supporting 13Cubed on Patreon at patreon.com/13cubed. *** 📖 Chapters 00:00 - Intro 01:19 - Demo 🛠 Resources CVE-2026-31431 (Copy Fail) Forensics:

Windows Defender Vulnerability lets malware install into System 32

The AI Conversation I've Been Avoiding

I’ve got some thoughts about AI. Let’s talk about how it’s changing digital forensics, how I actually use it in practice, and what you need to know if you’re in or entering the field. *** If you enjoy this video, please consider supporting 13Cubed on Patreon at patreon.com/13cubed. *** 📖 Chapters 00:00 - Intro 00:43 - Public Models 05:17 - Local Models 06:37 - DF/IR Tools + AI 08:25 - Vibe Coding 10:02 - Career Advice #Forensics #DigitalForensics #DFIR #ComputerForensics #WindowsForensics

Can Zero Trust Security save us? ThreatLocker Test

Threatlocker Review: Threatlocker is a security solution based on the Zero Trust model: We tested it against various malware, security attacks, simulations to see how it holds up in the real world.

CPU-Z and HWMonitor are Malware!?

NPM Axios Hack: Popular applications potentially infected by a RAT?

Kaspersky Test vs 200 Infostealers

Official Game Installs Malware

Mac Imaging Made Easy with Fuji

🎉 New for 2026! In this episode, we’ll look at Fuji — a free, open-source tool for performing live, logical forensic acquisitions of Mac computers (Intel or Apple Silicon). You’ll see how Fuji leverages built-in macOS tools to generate a DMG image, ready for analysis in your forensic tool of choice.

Undetected Discord Malware

Security-driven Rapid Release - Pwn2Own Documentary (Part 4)