Hack Me If You Can
summary
Covers concrete exploits and fixes: examples include cross-site scripting via injected HTML, session cookies leaked over open Wi‑Fi and via CSRF image requests, encoded-slash path traversal against Sinatra, clickjacking mitigations with X-Frame-Options, JSON-as-JS array-constructor exfiltration, CRLF header injection via unescaped redirect parameters, and compression attacks (CRIME/BREACH) that recover cookies or CSRF tokens. Shows using CSP and strict SSL/TLS, enforcing CSRF tokens even on GETs, escaping header input, and notes a previously undisclosed attack and a Travis YAML payload that could reach production DBs.
AI-written summary · about
chapters (11)
- 0:00Introduction and travel story
- 3:45Web security basics
- 9:34Cross-site request forgery
- 14:52Path traversal and clickjacking
- 18:23Same origin policy and JSON leaks
- 23:30Referrer header and header injection
- 29:56Cookie security and SSL attacks
- 35:21Advanced SSL attacks BREACH
- 38:09Trusting browsers and plugins
- 40:16Social engineering and server attacks
- 41:41Conclusion and Q&A
