Proactive Defense: Leveraging Hacker Tools for Early Vulnerability Detection
summary
Demo shows concrete tooling and findings: quick nmap reveals open SSH and robots.txt pointing to /ftp; Burp Suite intercepts requests and bypasses client-side checks to log in with an empty-password login; sqlmap identifies SQL injection (boolean and time-based), dumps users including MD5 and cleartext passwords; nuclei finds exposed Swagger and metrics; static analysis flags eval and a server-side template injection that executes commands (proven by a Python webserver). Live demos work end-to-end.
AI-written summary · about
chapters (14)
- 0:00Introduction
- 1:03Talk overview and tooling
- 13:01Live demo of target app
- 14:49Network scanning with Nmap
- 20:55Intercepting requests with Burp Suite
- 31:13Bypassing client-side checks
- 38:16Automating SQLi with SQLmap
- 51:27Quick scan with Nuclei
- 58:57Static analysis with Xengrab
- 1:04:22Server-side template injection
- 1:08:36Short break
- 1:19:23FTP misconfiguration attack
- 1:21:11Exploiting SQLi for admin
- 1:25:07Recap and call to action
related talks
22mIntegrating Security Measures Throughout Development
38mHackers Gonna Hack: Identifying and Fixing Vulnerabilities Proactively
39mHow to think like a hacker
57mEnterprise Ethical Hacking Cloud Applications
47mLive Hacking: Breaking into Your Web App
44mHack Yourself: Intro to pentesting with ZAP
58mOpen Source Pentesting and Security Analysis Tools: the DevOps way
13mFreedom of Security