This Is What Hacking Really Looks Like

Summary

The video documents a walkthrough of the Hack The Box machine Jarvis, covering web enumeration, initial access, and privilege escalation.

Web and Service Enumeration

The presenter begins with an Nmap scan and inspects the website, including its HTML, robots.txt, links, and a booking page that uses URL parameters. They also find a PHP-related directory and investigate the site’s database-backed functionality.

Database and Initial Access

The booking functionality appears vulnerable to SQL injection. The presenter uses it to enumerate database information, including tables and user-related fields, then uses the recovered information to pursue access to the machine.

Privilege Escalation

After obtaining a shell, the presenter checks available sudo permissions and identifies a vulnerable command path involving user-controlled input passed to ping. They bypass the input restrictions to run commands and ultimately gain root access.

Takeaways

The presenter emphasizes understanding copied commands rather than blindly pasting them. After completing the machine, they also review other write-ups to learn about alternative approaches.

Guides or Reviews

This is a hands-on lab walkthrough, not a product review. The presenter plans to compare write-ups after solving the lab.

Main Speakers and Sources

The primary source is the presenter narrating the Jarvis walkthrough. A second participant briefly reacts during the root-access moment.