How hacking works - Web edition
summary
Live demos show working exploits: a malicious JPEG comment that tricks a PHP upload into executing code, a basename locale quirk that reveals a config file, and a MathJS prototype overwrite that spawns child processes to run shell commands. The CTF runs as a Docker CTF image called VCH hack and includes a node-serialize RCE demo that yields a reverse shell; node-serialize still has ~1,500 weekly downloads (peaked ~8,000). Practical, tool-focused, and all exploits execute successfully on the demo targets.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 8:09Hacking evolution
- 17:21Real-world hacking story
- 25:08Live demo setup
- 26:15PHP receipt uploader exploit
- 32:06Regex filter bypass in PHP bingo
- 38:34JavaScript prototype pollution
- 42:30Insecure cookie serialization in Node.js
- 49:46Key takeaways
- 50:49Q&A
