How hacking works - Web edition
summary
Live demos show four concrete exploits and how they’re found: a PHP basename encoding bug lets an attacker read config.php disclosure; uploading a PNG with malicious EXIF metadata triggers EXIF-to-PHP remote exec and spawns shells; stored XSS exfiltrates admin cookies via an XSS image beacon to a request-catcher; and a known node-serialize CVE gives serialize RCE via node-serialize (CVE) leading to a remote shell and flag. Tools used include Docker, exiftool, netcat and a CTF portal called Hack the Bank; the demos work live and returned surprises like 73 stolen prizes and 5,941 applicants.
AI-written summary · about
chapters (13)
- 0:00How hacking works on the web
- 2:10Beyond Hollywood myths
- 8:06Types of hackers
- 12:43Why vulnerabilities exist
- 14:30Hacking story with cinnamon buns
- 19:29Security testing and CTFs
- 25:50Web vulnerabilities origins
- 29:44Santa's Bingo challenge demo
- 39:14Receipt uploader exploit demo
- 44:35Cross-site scripting demo
- 50:12Serialization vulnerability demo
- 57:55Key takeaways
- 59:01Q&A
