How to hack an Angular app?
summary
Shows a concrete chain: GitHub webhooks hit a localhost bypass (bar 0), use a Python HTTPConnection CRLF injection to smuggle an HTTP request into memcache, poison serialized keys and trigger an instance_variable_proxy deserialization RCE that runs arbitrary shell commands (demoed with a PoC script). Cites Equifax leaking ~200 million records from an unpatched framework vuln, mentions Metasploit, NSP and GitHub dependency graph, and warns about typo-squatting on npm (fake crossm had ~1M installs) and protocol smuggling.
AI-written summary · about
chapters (6)
- 0:00Introduction to hacking
- 0:42Defining vulnerabilities
- 2:35The GitHub hacking story
- 16:08The Equifax breach lesson
- 23:39Securing web applications
- 26:27NPM and supply chain attacks
