How hacking works; Web edition

on YouTube ↗40m

" summary

Demo uploads a JSP webshell to Tomcat 8 via HTTP PUT, yielding remote command execution and reading a flag; prototype pollution in mathjs lets an attacker reach require and spawn a shell from a Node backend; a Flash ad client leak lets a student call the prize-generation endpoint and claim 73 free cinnamon buns; an internal bank CTF even produced an accidental SQL injection that deleted a challenge database. Tools and artifacts shown: JSP webshell, mathjs prototype pollution, Docker CTF images (Juice Shop, netcat), Hack The Box and CVE references.

AI-written summary · about

" chapters (11)

1. 0:00Introduction and speaker intro
2. 3:20What hacking really means
3. 9:03Why breaches happen
4. 15:56Learning from failures
5. 17:45Capture the Flag basics
6. 21:18Web vulnerabilities overview
7. 23:26CVE and risk assessment
8. 23:48Live demo Tomcat exploit
9. 27:21Live demo JavaScript exploit
10. 31:01Live demo cookie manipulation
11. 37:29How to improve security

" related talks

• 53mHow hacking works - Web editionEspen Sande-Larsen · NDC Oslo 2024
• 51mHow hacking works - Web editionEspen Sande-Larsen · NDC Sydney 2024
• 02h 27mHow hacking works (Workshop edition)Espen Sande-Larsen · Build Stuff 2024
• 01h 01mHow hacking works - Web editionEspen Sande-Larsen · NDC Oslo 2023
• 53mHow hacking works - Web editionEspen Sande-Larsen · NDC London 2024
• 41mLive Hacking: Breaking into Your Web AppBrian Vermeer · GOTO Amsterdam 2022
• 43mLive hacking: Breaking into your Java web appBrian Vermeer · Conf42 Enterprise Software 2021
• 01h 06mLive hacking: Breaking into your Java web appBrian Vermeer · Global Summit for Java Devs 2020