Hack Me if You Can

on YouTube ↗29m

" summary

Shows a concrete React to Shell 10/10 remote RCE: crafted react flight JSON with __proto__.constructor.constructor executes payload and runs execSync. Demonstrates exploitation with Burp Suite exploit payload against a downgraded Next.js app, listing files and killing the server. Shows a separate CORS demo where vulnerable crypto app with Access-Control-Allow-Credentials:true lets a phishing page exfiltrate session data. Recommends Dependabot/Renovate, JFrog proxy, DOMPurify, and waiting 48+ hours before auto-updating.

AI-written summary · about

" chapters (9)

1. 0:00Developers and security
2. 1:45React Server Components flaw
3. 7:25React to Shell exploit demo
4. 9:56Frameworks vs XSS
5. 12:05Access control risks
6. 15:59Supply chain attacks
7. 20:31CORS dangers
8. 22:18CORS exploit demo
9. 27:15Key takeaways

" related talks

• 47mLive Hacking: Breaking into Your Web AppBrian Vermeer · Heapcon 2019
• 33mOffensive Javascript Techniques for Red TeamersDylan Ayrey, Christian Frichot · BSidesSF 2019
• 42mHack Me If You CanKonstantin Haase · Ancient City Ruby 2014
• 41mLive Hacking: Breaking into Your Web AppBrian Vermeer · GOTO Amsterdam 2022
• 42mModern web application bugsErlend Oftedal · NDC Sydney 2018
• 21mLet me show you how React applications get hacked in the real-worldLiran Tal · Voxxed Days Bucharest 2022
• 32mHow to hack an Angular app?Asim Hussain · ng-europe 2018
• 32mLet me show you how React applications get hacked in the real-worldLiran Tal · Nordic.js 2022