HackTheBox - Pikatwoo

00:00 - Introduction 01:00 - Start of nmap 03:15 - Identifying all the technologies used in the box 10:45 - Looking at OpenStack Keystone Authentication and discovering CVE-2021-38155 12:15 - Pulling up API DOCS to see how to login to Keystone, then testing lockout 14:00 - Taking the Burpsuite Request, sending it to FFUF and using a trick to try each password multiple times 25:30 - Attempting to access Swift as a vendor to bypass auth, using GoBuster and discovering an Android directory with Pokatmon app in it 35:10 - Start of analyzing the Pokatmon App, examining DNS, setting up a MITM with Burpsuite and Socat 40:15 - Using Frida to disable TLS Certificate Pinning on Flutter 45:20 - Discovering the App Signs every request, grabbing the certificate out of the app, and signing our own request 49:20 - Performing an SQL Injection, getting an email address then looking for vulnerabilities in Forgot Password on the main website 58:48 - Discovering CVE-2021-43557 in APISIX, which gi