Reverse-engineering JavaScript to get rid of trust issues
summary
Demonstrates how to reverse engineer a website by using DevTools: network tab to find the prebuilt “possible” discounts, breakpoints to land in the business logic, snippets and local overrides to inject a persistent “hack the store” button that deletes cookies and calls existing formatting functions. Builds and runs the exploit locally on a fake site, finds discounts are capped at 30%, and notes LLMs (GPT 5.5) can help but struggle on massive, bundled code.
AI-written summary · about
chapters (15)
- 0:00Welcome
- 1:40Not knowing is okay
- 3:02JavaScript’s power
- 4:49Reverse-engineering rigged game
- 7:17Network requests and state
- 10:26Game state with cookies
- 11:50Automating state reset
- 13:15Infiltrating with breakpoints
- 15:39Untangling obfuscated JS
- 19:14Renaming functions
- 20:38Reverse-engineering detective
- 21:21Modifying business logic
- 22:50AI versus human reverse-engineering
- 25:19Rigged game was a demo
- 25:39Closing and Q&A
related talks
40mHostile JavaScript: Attacking and Defending the Browser
33mOffensive Javascript Techniques for Red Teamers
39mExploiting Unknown Browsers and Objects
52mBreaking Fraud and Bot Detection Solutions
43mAttacking Modern Web Technologies
27mReverse Engineering a Private API
02h 27mHow hacking works (Workshop edition)
58mExploiting web messaging implementations