How your Laravel application can get hacked, and how to prevent that from happening
summary
Live demos show a Laravel API leaking an entire database via a single unsanitized sort parameter and an upload endpoint turning a JPG into remote code execution. The talk uses sqlmap to extract tables and rows, PHPGGC to hide a gadget chain inside a phar:// image, and opens a reverse shell that escalates via a misconfigured artisan scheduler running as root. Takeaway: patch, validate every input, and drop unnecessary privileges.
AI-written summary · about
chapters (8)
- 0:00Laravel security risks
- 3:55SQL injection attacks
- 9:56Live SQL injection demo
- 10:17Object injection flaws
- 17:05Object injection to RCE
- 23:17Privilege escalation via scheduler
- 27:56Preventing Laravel vulnerabilities
- 30:04Closing and call to action
related talks
30mThink Like a Hacker
22mTh1nk Lik3 a H4cker
02h 14mWeb application security (Part 1)
22mLive Hacking Session Part 2
41mI’m an API Hacker and Here’s How I Hack Everything from the Military to AI
59mEasily Digestible Security Pills
55mWeb Application Security: Winning When The Odds Are Against You
01h 02mCode Review For Security