How to hack a web app?
summary
Claims that the biggest risks are known and unpatched vulnerabilities: Equifax breached via known Apache Struts vuln patched two months earlier and many breaches come from the same. Demonstrations use Metasploit, GitHub dependency graph, NSP, Azure Security Center and live exploits: webhooks allowed requests to localhost to hit port 9200 and kill Elasticsearch, a Python CRLF bug enables protocol smuggling via CRLF injection into memcached that stores serialized payloads which deserialize and run, and a typosquatted npm package exfiltrates env vars.
AI-written summary · about
chapters (5)
- 0:00Start
- 3:15Vulnerability vs. Exploit
- 7:4277% of 433,000 Sites Use Vulnerable JavaScript Libraries - smyk.io
- 9:49Summary
- 17:48set key
