00:34 - Explaining how networking is setup, then nmap
04:00 - Examining why nmap says a port is filtered in Wireshark
07:30 - Exploring the webpage and doing basic SQL Injections in the search functionality
08:10 - Starting GoBuster in the background, #AlwaysHaveReconRunning
10:10 - Explaining SQL Injection
13:55 - Explaining SQL Union Injection
15:15 - Testing Union Injection by doing "UNION SELECT", then testing it by doing "ORDER BY".
19:00 - Explaining how to get data out of INFORMATION_SCHEMA
20:55 - Doing GROUP_CONCAT to extract multiple lines from a UNION Statement
27:00 - Using SED to replace "," with line breaks and extracting a bunch of information out of the database
33:00 - Cracking the hash to see admin's password is transorbital1
34:41 - Using wfuzz to brute force a login prompt with two FUZZ Variables (some troubleshooting)
43:30 - Fuzzing the MANAGE.PHP script for a filename parameter with wfuzz
48:50 - Exploring the LFI
1:00:00 - Using LFI with /proc/sched_debug to get processes running and discovering KnockD
1:04:30 - The Opening up the SSH Port with port knocking
1:10:00 - Using medusa combo list to test SSH Credentials, then logging chandlerb and running linpeas
1:16:00 - Exploring the MySQL Database, discovering Janitor was created at a different time. Explore his directory to discover new credentials
1:22:00 - Using find to output a list of readable files for other users then finding files that can only be read by single users
1:28:50 - FredF can execute the "test" binary as root. Looking at source, it allows appending lines to a file.
1:30:15 - File Write Method 1: Appending a line to allow joeyt to sudo
1:33:30 - File Write Method 2: Appending line to passwd to create a new user
1:36:50 - Extra content, going over the Source Code to view the LFI Exploit and a pretty funny login bypass bug