Something Something Security

on YouTube ↗57m

" summary

Shows that weak secrets and trivial social engineering leak real passwords, Google dorking and exposed web.config/FTP files reveal sa credentials and hundreds of production backups, automated tools like HAV extract databases end‑to‑end in minutes, and cheap VINs or public HTML files expose accounts; cites 43,000 pathology files and 2,000+ exposed SQL.gz results. Demonstrates practical defenses: browser Subresource Integrity plus a local fallback prevents malicious CDN JS, and Fiddler proofs show attacks are easy and fixes are effective.

AI-written summary · about

" chapters (5)

1. 0:00Start
2. 17:30let me rephrase this from a sequel injection perspective
3. 20:32exploit your vulnerable code
4. 34:43pulling jquery from the cdn
5. 52:54streamline checkout process

" related talks

• 01h 01mSomething Something CyberTroy Hunt · NDC Oslo 2017
• 59m50 Shades of AppSecTroy Hunt · NDC Sydney 2016
• 01h 27mProactive Defense: Leveraging Hacker Tools for Early Vulnerability DetectionTobit Lill · code.talks 2023
• 50mDefensive Programming - A Look at how to Break your Web AppNiall Merrigan · GOTO Aarhus 2013
• 43m50 Shades of AppSecTroy Hunt · OWASP AppSec Research (AppSecEU) 2015
• 22mDevSecOps - The Story of 3 Security BreachesYash Kadakia · SREday London 2022
• 59mHack Yourself FirstTroy Hunt · Web Directions South 2013
• 01h 10mHack to the FutureTroy Hunt · NDC London 2019