Defensive Programming - A Look at how to Break your Web App
summary
Live demos show an uploaded .aspx file allowing web.config leakage so full connection strings and the machineKey are downloaded; that key plus a leaked SAM lets attackers brute‑force Windows passwords (he cites a 25‑GPU cluster at ~186 billion attempts/min, cracking many in hours). A SQL injection demo extracts the ASP.NET membership table and reveals passwords stored encrypted not hashed, proving why bcrypt/sha256 hashing and server‑side validation plus proper file upload checks, custom errors, and config transforms must be enforced.
AI-written summary · about
chapters (12)
- 0:00Start
- 13:13Passwords
- 16:28Roll Back Wednesday
- 20:00Double Factor Authentication
- 26:43Delegation of Rights
- 27:44How To Hack the Ias Meta Base
- 28:47Why Does Search Need Write Permissions
- 31:03Directory Traversal
- 39:31Sql Injection
- 40:44Cookies
- 45:01Union Query
- 49:13Basic Security Principles
related talks
57mSomething Something Security
01h 01mThe Code Behind The Vulnerability
53mHow hacking works - Web edition
01h 01mSomething Something Cyber
47mLive Hacking: Breaking into Your Web App
30mWeb Security Engineering - Protect all layers of your project
01h 27mProactive Defense: Leveraging Hacker Tools for Early Vulnerability Detection
55mWeb Application Security: Winning When The Odds Are Against You