How hacking works - Web edition
summary
A mini CTF on GitHub runs via Docker compose and reproduces three concrete web exploits: a PHP basename + locale/regex angle that leaks config.php, an image EXIF trick that embeds and executes PHP using exiftool after renaming to .php, and an insecure npm node-serialize deserialization that spawns a reverse shell; tooling shown includes whatweb and base64 cookie tampering, surprising outcomes include one student claiming 73 cinnamon buns, ~2,393 weekly downloads of the vulnerable package, and 5,941 CTF applicants.
AI-written summary · about
chapters (13)
- 0:00Introduction
- 3:06Hollywood hacking
- 5:01The evolution of hacking
- 8:45Hacker types and motivations
- 11:41The cinnamon bun incident
- 15:28Lessons from failure
- 17:54Capture the flag basics
- 22:19Web security landscape
- 25:32CTF resources
- 28:20Demo: Santa's Bingo
- 35:42Demo: Receipt uploader
- 40:58Demo: Serial killers
- 48:52Takeaways and Q&A
