This video showcases how to hack any flash game using BurpSuite and JPEXS Decompiler. Note that the information showed in this video should not be used for any illegal purposes.
00:00 - Video context
00:49 - Tools used for the hack
02:22 - Swords and Sandals 2 before hack
05:04 - Clearing cache and downloading SWF file
08:48 - Decompiling SWF file and modifying the code
17:02 - Serving the modified SWF file to the server response
17:49 - Playing our hacked version of Swords and Sandals 2
The second video in the GCP series in which the threat actor must leverage an SSRF vulnerability to exploit a misconfigured application. The application supports the gopher protocol which can be abused to query the metadata service.
The first video in the GCP series features a scenario where participants are provided with a URL leading to a misconfigured storage bucket serving image files, prompting them to fuzz potential files, discover a backup zip file due to the entity being set to "Public" with "allUsers" granted Reader access, and completing the challenge by decrypting the zip file.
The objective of this scenario was to gain access to an RDS instance. We were provided with the credentials of two different users, and exploited this AWS environment in two different ways.
