How to hack a node app?
summary
Four concrete breach stories: a forgotten WordPress start script lets PHP run and an automated scanner like Metasploit compromise a VM; a SQL injection is fully exploited in about a minute with sqlmap to dump databases and spawn an OS shell; a GitHub Enterprise chain uses webhook routing + protocol smuggling into memcache and a deserialization gadget to run id on the server; an npm typosquat (cross vs cross-) exfiltrates env vars. Covers exact exploits, tools, timelines and fixes (patch, sanitize, use PaaS, scoped packages).
AI-written summary · about
chapters (10)
- 0:00Introduction and personal story
- 5:58How I got hacked on Event Sushi
- 11:44Defending against automated attacks
- 17:05Why you can’t DIY security
- 18:11SQL injection attack demo
- 23:36Taking over a server in a minute
- 23:59GitHub Enterprise exploit chain
- 35:48Smaller exploits build big attacks
- 36:09Malicious NPM module attack
- 39:20Key security takeaways
