Using Chrome Developer Tools to hack your way into concerts
summary
Shows concrete steps using Chrome Developer Tools: use XHR breakpoints, filter network by domain and type, inspect request/response and stack traces in Sources, and copy as cURL to replay requests. Recreates a ticket site locally, finds a rotating ID token, discovers the needed sequence (start then count), writes a Python script to automate the start+count flow and gets hundreds of views locally. Also demonstrates replay XHR and suggests mitigations like CAPTCHA, DOM randomization, and behavioral timing checks.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 1:08Swifties
- 3:26iframeplayer
- 9:24Revisiting the count request
- 10:28Using curl
- 11:48Debugging
- 14:34Troubleshooting
- 16:47Automation
- 18:27Preventing BOTS
related talks
27mReverse Engineering a Private API
48mA Weakness In Chrome & A New Hacking Technique
27mReverse-engineering JavaScript to get rid of trust issues
43mAttacking Modern Web Technologies
26mLoophole: Timing Attacks on Shared Event Loops in Chrome
27mSaimon Sharif - We'll do it live: Underhanded Debugging Tactics
33mOffensive Javascript Techniques for Red Teamers
14mBasics of Performance, Security, and Accessibility Testing