Live Hacking: Breaking into Your Web App

on YouTube ↗47m

" summary

Demo shows concrete, reproducible breakins: path traversal via URL‑encoded ../ to read /etc/passwd and package.json, ReDoS with a 60,000‑char regex payload that pins Node.js CPU and forces autoscaling (denial‑of‑money), and Apache Struts OGNL RCE via a crafted Content‑Type header that runs bash. Also demonstrates a Zip Slip against an old ZT unzip that overwrites JDK binaries. Uses curl, crafted headers, uploaded zips and repo/package scans; recommends shift‑left dependency scanning in IDE/CI plus daily production snapshots.

AI-written summary · about

" chapters (8)

1. 0:00Introduction to security talk
2. 5:55Security in DevOps culture
3. 15:38Live path traversal hack
4. 22:57Regex denial-of-service demo
5. 26:10Apache Struts exploit walkthrough
6. 31:00Zip slip vulnerability demo
7. 34:40Solutions and team culture
8. 43:18Q&A and resources

" related talks

• 41mLive Hacking: Breaking into Your Web AppBrian Vermeer · GOTO Amsterdam 2022
• 01h 02mLive Hacking: Breaking into your Web AppBrian Vermeer · Developers Summit 2021
• 40mLive hacking: Breaking into your web appBrian Vermeer · Codemotion Berlin 2019
• 46mLive hacking: Breaking into your Java web appBrian Vermeer · Devoxx Belgium 2019
• 01h 06mLive hacking: Breaking into your Java web appBrian Vermeer · Global Summit for Java Devs 2020
• 43mLive hacking: Breaking into your Java web appBrian Vermeer · Conf42 Enterprise Software 2021
• 53mHow hacking works - Web editionEspen Sande-Larsen · NDC Oslo 2024
• 40mHow to hack a node app?Asim Hussain · GDG DevFest Ukraine 2017