How hacking works
summary
Live demos show concrete exploits: a 32-bit ELF with no stack canary is return-oriented programming exploited via GDB to overwrite the return address and jump to win; a 64-bit remote service yields a format-string leak after Ghidra analysis and a pwntools script to dump environment and the secret flag; a web upload accepts JPEG metadata with embedded PHP and a renamed file executes code, and a Node.js mathjs flaw allows remote code execution via process.mainModule.require. A past incident let one user claim 73 prizes.
AI-written summary · about
chapters (19)
- 0:00Introduction
- 0:38How hacking works
- 4:22Informal poll
- 6:13What is this talk
- 6:40What is hacking
- 8:38Who are the hackers
- 9:56Why hacks happen
- 11:32How Espen got hacked
- 16:24CTF Tournament
- 18:05Hacking Categories
- 21:07Hacking Events
- 22:47CTF Challenges
- 33:57Gitra
- 41:12Web challenge
- 45:47Grinch calculator
- 46:07How it works
- 47:30What do I get
- 47:59Result set
- 49:29calcsplit
related talks
01h 06mHow hacking works
53mHow hacking works - Web edition
02h 27mHow hacking works (Workshop edition)
01h 01mHow hacking works - Web edition
51mHow hacking works - Web edition
51mExploiting Hardware Glitches And Side Channels In Perfect Software
53mHow hacking works - Web edition
47mLive Hacking: Breaking into Your Web App