YT YouTube2Text

YouTube2Text → Transcripts → ASÍ LOS HACKERS USAN LA IA ( SIN RESTRICCIONES NI BLOQUEOS )

ASÍ LOS HACKERS USAN LA IA ( SIN RESTRICCIONES NI BLOQUEOS ) — Transcript

by Gorka El Bochi Morillo · 5,835 words · 871 segments · language en · Watch on YouTube

Open in transcriber Summarize with AI Download SRT/VTT

Full transcript

0:00If you try to do hacking using
0:01artificial intelligence, you'll get a
0:03message like this and you won't be able
0:05to.
0:06It doesn't matter which AI you're using
0:08; as a result of this, you aren't taking
0:10advantage of 70%of its power.
0:12In this video, I’m going to teach you
0:14three things. We’re going to divide it
0:16into three parts. In the first part,
0:17I’ll show you how to prevent this
0:19message from appearing and how I avoid
0:21it myself.
0:22In the second point, I’ll show you a few
0:25very good skills and resources so you
0:26can use artificial intelligence for
0:28hacking.
0:29And in the third point, I’ll teach you
0:31how to use these resources to hack the
0:33AI. Literally copy what I’m doing, and
0:36you’ll get very good results doing
0:38hacking with AI.
0:40It’s very important that you stay until
0:42the end, since it’s useless to have a
0:43driver's license if you don't know how
0:45to drive the car.
0:47Therefore, it’s not only important to
0:49get this permission approved—which I
0:50will teach you how to do—but also to
0:52know how to actually use it for hacking
0:54afterward.
0:55In this case, the first thing I’ll show
0:57you is how I bypass this restriction and
0:59can actually use it for hacking by going
1:02over here and deploying a cloud code.
1:04You can use any artificial intelligence
1:06, be it Claude, ChatGPT, or whatever.
1:09It’s exactly the same. And over here I
1:11have a lab set up, and I’m going to tell
1:13it to hack it, and you might say, "
1:14Gorka, you're doing it in a lab, the
1:16message won't pop up." Believe me, it
1:17will. Try the prompt I’m going to enter
1:20now yourself and tell me if it pops up
1:21or not. Well, I’m going to click here
1:24and copy the IP address. I’m going to
1:26tell it to hack this lab and tell it to
1:29get an RCE. Get an RCE. An RCE is
1:32probably the most serious vulnerability
1:34that exists in hacking. I’m going to
1:37paste the prompt here, and we'll see if
1:38this same restriction appears for me or
1:40not. I’m not touching anything; there
1:42won’t be any cuts now. And let’s see if
1:43it says anything to me. And it says, "I
1:45am going to attack the lab at whatever.
1:46" If you enter this same prompt, I
1:48assure you that it will appear for you,
1:49or any other prompt for that matter. And
1:51well, I have this ready here. Well, I’ll
1:54leave it running, and we’ll watch how it
1:55does it. Well, you’ve already seen how
1:58it’s going to be hacking away over here
2:00. It’s doing its own little thing. We’ll
2:02see how it does it as the video
2:04progresses.
2:05Anyway, I’m going to show you how to
2:07avoid triggering this restriction so you
2:09get the same result as me when you enter
2:11these kinds of prompts.
2:12To do this, we’re going to go to a
2:14browser. I have it open here, but I’ll
2:16show you how to search for it.
2:18You need to search for "Anthropic CVP
2:21program" and look specifically for the
2:25word "portal."
2:27When you perform this search, you need
2:30to click on this link right here. You’re
2:32going to click it, and it will take you
2:34to the login page. I’m in incognito mode
2:37in this tab, which is why it shows I’m
2:39not logged in, but I’m logged in on this
2:41other tab and this is what shows up for
2:43me. It will show you exactly the same
2:45thing. Cybersecurity program.
2:47I’m basically going to do this along
2:49with you. I’m going to show you how you
2:51need to submit this application, because
2:53if you do it even slightly wrong,
2:54they’re going to reject it. So,
2:56literally do what I’m doing—I mean, copy
2:58me exactly. So, alright, we’re going to
3:01go here. You will see this same thing,
3:02and we’re going to click "Apply" here.
3:04We’ll click here, and I’ll click up here
3:07on the right, and a form will appear.
3:09I’ll make it a bit larger so you can see
3:10it clearly. And perfect.
3:13It’s a nine-step form, but it’s super
3:14important that you copy me and do
3:16exactly what I do and what I tell you at
3:17each step, because I have a bunch of
3:19friends who got rejected.
3:21Therefore, well, this is what I get here
3:23. What best describes you? What I put
3:26here, and what I always select, is the
3:28first one. Individual Security
3:30Researcher. With this, we are telling
3:32them that we, as individuals, without
3:34working for any company—that is,
3:36completely independently—dedicate
3:37ourselves to finding security holes in
3:39companies.
3:41Something very important you have to
3:43understand is that we will use this
3:44ethically; that is, the capabilities
3:46they give us will be used in an ethical
3:48way. That is super important, okay? We
3:50will not use it to do any harm.
3:52So, okay, then we indicate our residence
3:55, which in my case is Spain, and down
3:57here we basically have to say what we
4:00are going to do with this.
4:02In this case, I am going to check this
4:04one here, which is basically bug bounty
4:06. I’m going to take a brief 30-second
4:08detour to explain this to you because
4:10it’s important that you know it.
4:12Bug bounty is basically looking for
4:14vulnerabilities independently from your
4:17home, wherever you live, and searching
4:19for vulnerabilities in well-known
4:21companies like, for example, Hostinger,
4:24Inditex, uh, X, Shopify.
4:26All of these are companies that have a
4:27bug bounty program. So you, from your
4:29home, look for vulnerabilities in these
4:31companies, report the flaw to them, and
4:33they pay you for it. Depending on the
4:35criticality of the flaw, depending on
4:36the impact it has, they will pay you
4:37more or less.
4:39You can do this from anywhere in the
4:40world, without a contract, without
4:42anything, today, right now. Okay? I have
4:44a ton of videos talking about this topic
4:45. When you finish this one, watch them,
4:48but it’s basically just that.
4:50So we are going to say that we want it
4:52for that, to search for vulnerabilities
4:54completely independently in bug bounty
4:56programs, since in this case we are
4:57going to explain it here a little bit.
4:59Just tell ChatGPT to do this for you,
5:01there's no problem. And in this case, I
5:03will put a period to enter anything and
5:05I will click continue over here.
5:07So, well, let's continue here with the
5:08next step.
5:10In this case, it is telling me to verify
5:12my own identity. What we have to do here
5:14is the typical process of verifying our
5:16identity with a national ID, with a
5:18passport, or whatever, okay? This will
5:20simply be taking a photo of your ID and
5:22putting it here and that's it. Nothing
5:24will happen at all.
5:26Also, I’m not going to do this step now
5:28, but as you move forward in the form,
5:30it will tell you to provide your bug
5:32bounty profiles.
5:34So, what are we going to do for these
5:36same steps?
5:37We are going to go to a platform like
5:39HackerOne, and HackerOne is a bug bounty
5:41platform, which means that HackerOne has
5:43a ton of companies, as you are seeing
5:45here: PayPal, Shopify, Snapchat, TikTok
5:47.
5:48It has a ton of companies that let you
5:50hack them and they will pay you for it.
5:52So, we will have to create an account
5:53here. In fact, I am going to open a
5:55regular browser to show you mine. It
5:57just opened a browser for me here, I'll
6:00move it up here, and if I log into my
6:02HackerOne, for example, I have to sign
6:05in, but I’ll show it to you from my own
6:07platform.
6:08This is a platform I recommend you take
6:11a look at, it's 100%free, where you can
6:13create a cybersecurity portfolio. I'm
6:15already logged into HackerOne; you can
6:17see here I was in incognito, but this is
6:19my main browser. And well, basically,
6:21this is HackerOne. Creating an account
6:23is super easy to do. You log in, enter
6:25your username and password, and that's
6:27it. And here, in this case, I'm showing
6:29you my profile, for example, where it
6:31shows I've hacked companies like
6:32Hostinger, Quora, and Inditex, and
6:34they've paid me for it. Okay, this is
6:36very cool. I have a ton of videos
6:37talking about this, I recommend you
6:39watch them, but it’s very important that
6:40you at least create an account to
6:42request this same certificate and this
6:43same application, okay? For this very
6:45thing.
6:46So, well, you're going to provide your
6:47profile, meaning you'll copy the URL
6:49here. You're going to go here to the CVP
6:51, to this form, and you're going to
6:53paste it in. I imagine it's right here;
6:55it seems like in this step you'll have
6:57to attach it, and that's all.
7:00When I filled out this form, I did it
7:01exactly by using ChatGPT, meaning I kept
7:03asking it, "Hey, what should I answer
7:04here?"
7:06Always do it from the perspective of
7:07being sincere, meaning give them your
7:09actual profile and do everything
7:10properly, okay?
7:12So, well, we have these steps here, you
7:14fill them out, and over the next few
7:15hours, they will grant you permission.
7:18You will receive an email telling you if
7:19they have accepted or denied it.
7:21So, something very important I want you
7:23to know is that it's likely they might
7:24turn you down. It is entirely possible.
7:27In fact, it has happened to many friends
7:29of mine that they were turned down, but
7:30it's no big deal because you can
7:32resubmit it in a week.
7:33You have a small waiting period of a
7:35week, and then you just resubmit it, and
7:37it's fine. I have friends who had it
7:38accepted on their third, fourth, or even
7:40first try. Okay, so don't worry about
7:42that.
7:44But well, once we have this, as I told
7:46you, it’s useless to have this
7:48certificate, to do it and all, if you
7:50don't know how to use it correctly.
7:53And since it’s going to take them days
7:55to resolve it for you, watch this video
7:57until the end and just take notes on
7:58everything.
8:00And well, we are going to talk about how
8:01to use this for hacking. I have my
8:03Claude here, by the way, let’s see how
8:05it does it. And here it has already
8:07pulled a few flaws, I think, and it got
8:08an RCE in the end. I mean, it’s crazy.
8:11In the end, it has managed to execute
8:13commands.
8:14I mean, you can basically freak out here
8:15. I mean, it hacked the entire lab and
8:17it’s outrageous. But well, let's get to
8:20the point.
8:21Skills for doing hacking with artificial
8:23intelligence.
8:25There is one that I really like, that I
8:27always recommend to you, and it is that
8:28you have to go to your browser and
8:30search for Claude Bug Hunter.
8:32You go here, search, and it’s this one
8:34here, it seems. I'm going to enter here
8:36and indeed it is this one here.
8:38This is a great skill, in this case it’s
8:41for Claude, but as I said, you can use
8:43it in ChatGPT, or well, Codex, whichever
8:45you want.
8:46But well, what is this here?
8:48This is a skill that I will now teach
8:50you how to install and use, which has a
8:52lot of subskills, you see here, and it
8:54has bug bounty skills, it has
8:56reconnaissance skills, specific
8:57vulnerability skills, absolutely
8:59everything.
9:01It’s crazy. Logically, it is highly
9:03recommended. It is the one I always
9:04recommend. And well, to the point, how
9:06do you install this? We are going to
9:07click here where it says code and we are
9:09going to copy this URL here. We are
9:11going to copy this URL. We are going to
9:12go to our Claude or Codex or whatever.
9:15In this case, I am going to clear the
9:17session and I am going to tell it to
9:20install this hacking skill.
9:22I'll give it this, I'll paste the
9:24skill's URL and that's it. I enter this
9:26. And now as I say, I don't want to make
9:28cuts because I want you to see what it's
9:30really like.
9:32And now what it will be doing is that it
9:33will be here installing the skill.
9:36And here it tells me, I'm going to
9:37install the skill first, clone the repo
9:38, yadda yadda, yadda yadda, yadda yadda
9:39. Perfect. So, now it will do it itself
9:41. You can install it manually. Honestly
9:44, I'm very lazy, so I always tell Claude
9:46to install the skills, MCPs, and
9:48everything, but you can also do it
9:51manually. In fact, right here, it shows
9:53you exactly how to do it, okay? I think
9:55it's easier to install it manually than
9:57how I did it, but I’m just too lazy. So
10:00, I just tell it to do it directly.
10:02So, well, it's already installing the
10:04skill here, entering different commands
10:06, and setting things up.
10:08In this case, I already have it
10:09installed. I don't know if it will
10:10detect that.
10:12Maybe I don't have it installed in this
10:14project, but hey, once it's installed,
10:15I'll show you how to use it and how to
10:17hack an application using this cool
10:19skill.
10:21And well, installer, so-and-so,
10:22so-and-so, so-and-so. Anyway, let's see
10:24how it goes.
10:26And I'm also going to show you something
10:28very interesting: I'll teach you how to
10:29use the MCPs that I use to hack
10:30applications.
10:32This is very important and it's going to
10:34surprise you a lot.
10:35I'm going to have my Claude take control
10:38of my browser so it can directly use
10:40Google as if it were literally me and
10:42hack the application.
10:44I mean, it will click around the page
10:47itself, log in, input payloads, and do
10:50absolutely everything.
10:53And well, it seems like it's finishing
10:55up now, and perfect, 83 hacking skills
10:57have been installed.
10:59In fact, if we type/skills here, we can
11:01see them right here. If I scroll down,
11:04we have a ton of hacking skills here.
11:07These are all the ones we’ve installed.
11:09There's a whole bunch of them here. And
11:10well, perfect. How are we going to use
11:12them now?
11:13The best way I recommend using these
11:15skills is to use them alongside an MCP.
11:18As I mentioned, an MCP is like giving
11:21Claude arms and eyes.
11:24For example, the Gmail MCP allows Claude
11:27to access your Gmail inbox to see emails
11:29, reply to them, and so on.
11:32It gives it arms and eyes because it
11:33provides both actions and visibility. In
11:36this case, there's one MCP that I really
11:38like, which is the Chrome MCP.
11:40The Chrome MCP is basically what will
11:43allow Claude to open a browser and
11:45perform actions within that browser. If
11:48I type slash mcp, you'll be able to see
11:50that I have a few installed here. I have
11:52the Gmail one, the World Calendar one,
11:53and so on. But here, the one I'm
11:55interested in is this one, Chrome
11:57DevTools and Chrome in Chrome. They are
12:00two different ones. And how do you
12:01install this MCP? Well, just like before
12:03, we're going to tell it here, install
12:05the Google Chrome MCP. I mean, you
12:07literally just tell it this and that's
12:08it. There are two ways to do it.
12:10There's the Google Chrome extension,
12:11which I recommend a bit less, and
12:13there's another way where you just tell
12:14it this directly and it will do it for
12:16you, okay?
12:17But anyway, we're going to use this to
12:18hack, okay? Let's get down to business.
12:21To do this, what are we going to tell it
12:22? First, we need a victim. In this case
12:24, the victim will be this lab right here
12:26. Let's take a look at it. We're going
12:28to go here to our browser and see what
12:30this lab has. I'll go in here and we see
12:33it says B Keim, or whatever. Perfect.
12:35Let's create an account. Let's see a
12:37little bit of what this application has
12:38, right? For example, for company name,
12:40I'll put Gorcavo.
12:42For Your name, the same. Work email
12:44[email protected] and for the password
12:46, the same.
12:47Once we create the account—and I'll make
12:50it a bit bigger so you can see it well—
12:52different things will appear.
12:55We see that we have vaults, which
12:56basically, so you can imagine them, are
12:58like secret compartments in our account
12:59.
13:01For example, imagine a password manager
13:03where we put our passwords and save them
13:05there.
13:06Well, this would be something very
13:08similar, but for saving all kinds of
13:10information. So, anyway, let's move
13:12forward a little. We've seen the website
13:14, we see it has a web and everything is
13:15cool. Now we're going to tell it to hack
13:17it. I've cleared the previous context,
13:19so it doesn't know it has hacked it. If
13:21you remember at the beginning of this
13:22video, we told it, "Hey, hack this
13:24website."
13:25And it did it. It found vulnerabilities
13:27and did things. But let's go a little
13:29further, shall we?
13:31The first thing we'll tell it is, use
13:33the reconnaissance skills.
13:37Damn, I can't spell reconnaissance, to
13:42see what functions and things this lab
13:46has. Let's put this in just like that.
13:49The first thing, whenever you're going
13:51to hack an application, I recommend you
13:52do this exact thing: tell it there are
13:54three phases to a hack: reconnaissance,
13:56exploitation, and escalation.
13:58So, we're going to perform those three
14:00that this lab has.
14:03Okay, I'm going to put our victim's IP
14:05here. In this case, you could provide a
14:07domain, okay? I'm going to tell it to
14:09use the reconnaissance tool, whatever,
14:12and look for bugs. I'm going to tell it
14:13something very important here.
14:15I'll tell it to use the Chrome mcp right
14:19here.
14:20If I knew how to type, guys, I really
14:22need to take a typing course urgently.
14:24Use the Chrome skills to see the web and
14:27look for the bugs.
14:30put. Perfect. I'll enter this, put my
14:33hands up so you see I'm not cutting
14:34anything or doing anything, and let's
14:36see what happens here.
14:38In this case, it uses the reconnaissance
14:39skill, whatever. As I mentioned, a hack
14:41consists of three phases. First, we have
14:44to do reconnaissance, that is, see what
14:46we're facing and come up with an attack
14:49plan.
14:50Then comes the exploitation phase, where
14:52we have to exploit the vulnerabilities
14:53we found during this prior
14:55reconnaissance.
14:56And then comes the privilege escalation
14:59part, where we've already gained access
15:01to the server and we're going to gain
15:04full access to it, since generally when
15:06we hack a server, we don't start with
15:09full privileges.
15:11But anyway, let's see what it's doing
15:12here.
15:13Here it's saying it's a lab, and so on.
15:16And perfect. Now it's going to do a scan
15:19here.
15:20Now it's running NMAP scans and doing a
15:22few things completely autonomously.
15:25And I want to take this opportunity to
15:27say one thing, and that is that
15:29precisely because of this, because of
15:30what you're seeing now, it's the best
15:32incentive for you to learn cybersecurity
15:34. I don't consider cybersecurity to be
15:37like coding, where in the end, an AI can
15:39build a website for you or you can do it
15:41yourself by learning programming.
15:44Cybersecurity will always require you to
15:46tell it exactly what it has to do and
15:48how it has to do it.
15:49Therefore, let this complete craziness
15:52and this autonomy that you are seeing
15:54now not limit you when it comes to
15:56wanting to learn hacking, or demotivate
15:59you from wanting to take this seriously
16:01.
16:02So well, here it's doing different
16:03things. I'm going to give it a direct
16:05push. I'm going to tell it, "Create an
16:08account on the web and I want you to
16:10look for vulnerabilities," and in this
16:12case, I'll give it a spoiler, meaning
16:15I'll tell it where things are headed to
16:17go as fast as possible.
16:20It has an IDOR, the website, pull an RCE
16:23.
16:25In this case, I'm going to give it a
16:27little push directly and let it get to
16:29work. Once they accept this permission,
16:31you will receive an email telling you if
16:33it has been approved or rejected.
16:36In this one, once it’s been approved,
16:38you will go directly to your Claude, in
16:40this case, to your ChatGPT or whatever
16:42you're using, and you can start using it
16:45for hacking.
16:47So, to use the latest models, because
16:49we're on 4.8 now, if you look over here
16:52, but to use the 5.5 s, I think you'll
16:55have to make another request.
17:00But anyway, while the scan is running,
17:02I'll go ahead and explain a few points
17:03and we'll do a few little things.
17:06First off, how long does it usually take
17:07for Anthropic, ChatGPT, or wherever
17:09you're sending the request to respond?
17:12It usually takes a few days, or even
17:14just one day. They were quite fast for
17:16me, but I have friends who it took maybe
17:18a week or so, okay? Don't worry about
17:20that.
17:21It usually takes a different number of
17:22days, but this permission, in principle
17:24, does not expire.
17:25In principle, it is permanent, and I
17:27requested it I think at the beginning of
17:29the year and it still lasts, so I don't
17:30think it's much of a problem. And look,
17:32something very curious is that it has
17:34just started doing this right here. But
17:35anyway, while this is happening—which,
17:38by the way, it has opened a Chrome
17:39window over here and is literally using
17:41it as if it were me, right here, as you
17:43can see, it’s already using my browser.
17:46I'm going to put it over here so you can
17:47see it well. And the thing is, it has
17:49gained full control over my browser. I
17:51am literally not touching anything. That
17:53mouse isn't mine and this is crazy.
17:55To do this same thing, what you have to
17:57do is install this extension here, which
17:59is the Claude extension from the Google
18:01Chrome Store itself or whatever it's
18:02called.
18:04You can install this extension and the
18:06Claude code will automatically connect
18:08and do everything.
18:09Okay, in this case, I'm going to set it
18:11up like this so you can see it nicely,
18:13exactly, and so you can see a little bit
18:15of what it's doing.
18:17So it’s just crazy. I mean, for me,
18:19having done hacking for a lot of years,
18:21if someone had told me this was possible
18:23—that is, doing reconnaissance and all
18:25kinds of things with Claude—I honestly
18:28wouldn't have believed it.
18:30But wow, this is outrageous. Over here,
18:32what it’s doing on the right is drawing
18:34conclusions, right? It’s saying, "Whoa,
18:35it has this here, it has that there, it
18:37has another thing," and so on. And here
18:39on the left, what it’s doing is testing
18:41it.
18:42When I talked to you about giving eyes
18:43and hands to Claude, I was talking about
18:45this.
18:46This is really only 1%of what you can do
18:49, because there are a lot more things I
18:51want to delve into in other videos and
18:54content, but anyway, what it’s doing
18:56here is identifying different points.
18:59For example, the JSON Web Token, which
19:01is how you authenticate on websites, has
19:03a small flaw: it isn't signed, that JSON
19:06Web Token isn't encrypted.
19:08And here, well, it looks like what it's
19:10going to do now is steal an account or
19:12do something—it’s going to do something
19:14pretty critical. Literally, as you can
19:16see, I am not doing anything. I mean,
19:19this video isn't about me explaining
19:21hacking to you; this video is about how
19:23Claude hacks, literally.
19:25I mean, it's crazy.
19:26It just found an IDOR here. An IDOR is
19:28an Insecure Direct Object Reference
19:29vulnerability. Let me give you an
19:31example. When you create an account on a
19:33website, for instance, you are assigned
19:35an account identifier right then and
19:37there—in this case, account 1001, 1002,
19:401003.
19:41So, there are certain requests. For
19:42example, when you change your profile
19:44picture, what you're doing is telling
19:46the server, "Hey, I am account 100 and I
19:48want to change my profile picture."
19:51So, you send that request to the server
19:53.
19:54But what happens if, in that request,
19:55instead of saying you are account 1002?
19:57You say you are account 150.
20:00Well, if the server doesn't have the
20:02validations done correctly, it will
20:04allow you to tell the server that you
20:06are account 1050, it will believe you,
20:08and it will change the profile picture
20:10for user 1050.
20:13In this case, changing a profile picture
20:15isn't a very critical request, but if,
20:17for example, we do it for a password
20:20change, email change, or functions like
20:22that, it certainly can be.
20:25I mean, this is outrageous, total IDOR,
20:26and I don't know what, but it's doing
20:28things.
20:29I mean, literally, this video isn't me
20:30doing the hacking, it's the artificial
20:32intelligence doing the hacking.
20:35It’s complete madness what it's doing
20:37right here.
20:38In this case, well, we see that the
20:40algorithm accepted it, critical bypass,
20:42I don't know, and perfect.
20:44Something very curious, I'm going to
20:46explain what it's doing as we go, and
20:48that is that by abusing this
20:50vulnerability, it has managed to obtain
20:52an administrative token.
20:55Let me break down the attack chain it
20:57followed for you. It detected an IDOR in
21:00one of these vaults, which, as we
21:02mentioned before, a vault is like a
21:04small secret compartment for each user.
21:07Well, it accessed another user's secret
21:09compartment by abusing an IDOR and
21:11managed to extract a secret.
21:13The secret was that the tokens were not
21:16signed. So, when the token isn't signed
21:19, it has a quite serious problem, which
21:21is that it allows you, as a normal user
21:24, to set whatever token you want.
21:27So, once you set whatever token you want
21:28, you can set an administrative token.
21:30And in this case, that's literally what
21:32it did. It set an administrative token
21:35and obtained admin access.
21:37So, this is logically extremely critical
21:40. But anyway, I'm going to make a quick
21:42cut and we'll see what it's done. I made
21:44a cut of literally 2 minutes and look at
21:46the mess it’s already made here.
21:48It literally extracted 12 user secrets
21:51with the IDOR and pulled an RCE, the
21:53most critical vulnerability you can find
21:56in cybersecurity.
21:58Executing commands on the server is just
22:00outrageous. Right here it's giving us a
22:03little demo that it actually got it. And
22:05now we are going to use the AI to keep
22:08hacking.
22:09And in this case, look, it seems it even
22:11closed the browser on me.
22:13We're going to do some things now;
22:15precisely here it's telling me that it
22:17has already managed to execute code on
22:19the server, and what I'm going to tell
22:21it is the following.
22:23Over here what I’m going to say is, "
22:25Okay, great.
22:27Well, now I want you to access the
22:30server.
22:31If I know how to type, guys. I swear
22:33that after finishing this video I’m
22:35heading straight to a typing course.
22:38Access the server, and I want you to
22:42perform a privilege escalation and
22:46become root.
22:48What is this about becoming root? Well,
22:50let me explain it on my own computer,
22:52okay? I have my computer here, in this
22:54case, it’s a Mac. This is a completely
22:56normal terminal.
22:57And if I type" whoami, "in this case, we
23:00see that I am the user Gorka, but Gorka
23:02needs critical permissions to perform
23:04some actions.
23:06What kind of actions? Well, editing
23:07sensitive system files. For example,
23:10it’s like when you log into your Windows
23:12or whatever you have, you know how when
23:14you go to open an app, this popup
23:16appears asking," Do you want to run this
23:18with administrative permissions? "And it
23:20gives you a yes or a no. Well, this is
23:22literally the same thing.
23:24So in this case, I'm going to give you
23:25an example. If I type" nano/etc/hosts, "
23:28which is a critical system file, if I
23:31make a change and try to save it, for
23:33example, I type" hello "here, press
23:36Control X, press Y, and well, press
23:38enter in this case, it’s going to tell
23:41me" permission denied, "it says it right
23:44here. This is because I don’t have
23:46permissions to edit this file, which is
23:48critical at the system level.
23:50So, what do I need to edit critical
23:52system files? Root privileges.
23:55I need to gain root access. In this case
23:58, I am Gorka. And if I type" sudo whoami
24:00"and enter my computer password, for
24:02example, it will tell me that I am root
24:04. What is this" sudo "thing? When we put
24:07" sudo "before a command, it means we
24:09want to execute that command as root. In
24:12this case," sudo whoami "is root, and"
24:14whoami "by itself is just Gorka. Gorka
24:17doesn’t have privileges to edit that
24:19file, but root in this case does.
24:21If I type this same command and put"
24:23sudo "before it—wait, I got distracted.
24:26If I put" sudo "before it here, then it
24:28will let me edit it. For example, I’m
24:30going to change this name and put a" P "
24:32at the end, okay? Instead of an" L, "
24:34I’ll put a" P "here. I save the file,
24:37press enter, and it has saved correctly
24:39.
24:40In fact, now when I run a CAT—which is a
24:42command we use to see the content of a
24:45file—we will see that it now has an AP.
24:49But anyway, this is basically the same
24:50thing as when we hack a system.
24:53When we get into a system, we don't have
24:55root access; we have low-privilege
24:56access, and our goal is to become root,
24:58which is what I've asked the cloud to do
25:00.
25:01We've told it," Okay, you've managed to
25:03execute code on the server, meaning
25:05commands, but you aren't root; you can
25:07execute commands, but without much
25:09privilege. I want you to have full
25:11privileges. "The thing is, when we get
25:13full privileges on a server, we can do
25:16whatever we want.
25:17I mean, the server is ours in this case
25:19. Well then, what do we have here?
25:21Perfect. Now, privilege escalation from
25:23the RCE foothold. Perfect.
25:25It's doing a lot of things here. It's
25:27making quite a mess, as it has detected
25:30a super interesting vector, which is a
25:33vector for abusing crons.
25:36I'm talking to you here, it might sound
25:38like Greek to you, but I'm going to
25:39break it all down so you understand.
25:41What is a crontab? A crontab is a task
25:44that runs on your computer every so
25:46often. I'll give you an example, or even
25:48after a certain action. Why do I do this
25:50? Because I went for the cheapest Mac
25:52and it has very little space. So, I have
25:54a script that every 2 hours cleans up
25:56all the temporary files, and that's how
25:58I manage to recover space. Well,
26:00something very similar can happen on a
26:02server. In this case, on the server,
26:04what's happening here is that every
26:07minute—this means every minute—a backup
26:10script is being executed. What is a
26:12backup script? Well, for example, if you
26:14have sensitive files on your computer,
26:16you can make a script that sends those
26:18sensitive files to another server every
26:21half hour. That way, they stay a bit
26:23safer. If your computer falls out the
26:25window, you still have the backup
26:27somewhere, right?
26:28So, it's basically this.
26:30Here, what it's doing is that it already
26:32detects a vector. What is the vector it
26:33has detected? The vector it detected is
26:36that the backup runs as the root user,
26:39but you, as a low-privilege user, can
26:41modify the backup script.
26:44So, bringing it down to earth. How can
26:46we do this same thing?
26:47Basically, what's happening here is that
26:50the action is being executed as an
26:52administrator, but we can modify that
26:54action.
26:55Well, we can make that same script
26:57that's running as an administrator, we
26:58can make it do something else.
27:00For example, we can remove the password
27:02for the root user and we can access it
27:04as root. Do you see where I'm going with
27:06this? This is basically the flow and the
27:09game of privilege escalation. In this
27:11case, it detected the vector and root
27:13was achieved.
27:16Perfect, it managed to hack it and, in
27:18this case, it read the file that root
27:20had in its personal directory, which as
27:22unprivileged users we couldn't detect or
27:25read, much less.
27:27So, it literally did the whole hack on
27:31its own.
27:32I mean, I don't know if you realize how
27:34crazy this is, but as I told you before
27:36, and I'll say it again, I don't want
27:38this to discourage you in the slightest
27:40from learning cybersecurity and going
27:42for it, not at all.
27:44I mean, precisely because of this, it's
27:46the best time and the best reason to do
27:47it, because you've noticed that at all
27:49times I've been saying," Okay, so it did
27:51a JSON Web Token, it did the root, it
27:52did whatever.
27:54"Well, this kind of thing is, I mean,
27:56it's important that you have knowledge
27:58of cybersecurity and that you get
28:00trained, since with this, by training in
28:02cybersecurity, you understand what
28:04artificial intelligence is doing and you
28:06can kind of lead the way and tell it,"
28:08Okay, do this, do that, "because if not
28:10, you're going to waste your time, your
28:12tokens, and you won't have a clue what
28:14it's doing.
28:16Therefore, the best place to train in
28:18cybersecurity is this YouTube channel,
28:20which is completely free, and my Discord
28:22community, for which you have the link
28:24in the description.
28:26There are a ton of hackers learning
28:28cybersecurity there, and I do a live
28:30stream every week.
28:33I do a live stream, for example, on AI
28:35hacking, a live stream hacking a machine
28:37, a live stream doing anything, even a
28:39live stream answering questions, any
28:41kind of stuff, we do that weekly.
28:44So, join that community where I do those
28:45live streams; it's pretty cool. As I
28:47mentioned, if you've made it this far,
28:49you're a rockstar, I mean, you deserve
28:51the best in life.
28:52And anyway, I hope you do very well and
28:54that you liked this. I'm just here
28:56looking at what Claude has done because
28:57I'm freaking out. This is crazy.
29:00Like this video, subscribe if you
29:01enjoyed it, of course, leave me a
29:02comment and tell me what you think.
29:04Did you like it? Did you not like it? Do
29:06you prefer another? Which AI do you use
29:08? I’ll be reading all of you. And anyway
29:09, let’s get to it and hope it goes great
29:11. Yeah.

About this transcript

This page contains the full transcript of ASÍ LOS HACKERS USAN LA IA ( SIN RESTRICCIONES NI BLOQUEOS ) by Gorka El Bochi Morillo, generated from the public captions YouTube serves with the video. The transcript has 5,835 words across 871 segments, with the original timestamps preserved so you can click any line to jump to that moment in the embedded player.

What you can do with it

Use the transcript to take notes, quote the speaker, build a study guide, generate a summary with ChatGPT or Claude via the YouTube Summary tool, or export it as a timed subtitle file with YouTube to SRT. You can also re-open it in the transcriber to choose a caption track available on the video.

Free YouTube transcript tool

YouTube2Text is a free YouTube transcript generator — no signup, no daily limit. Paste any YouTube link and get the full transcript instantly, with timestamps, click-to-jump, caption language selection, AI prompts for ChatGPT, Claude, and Gemini, and exports to TXT, SRT, VTT, or Markdown.