Hack Yourself First
summary
Shows how trivial common breaks are: credit card photos scraped from Twitter, FTP-indexed web.configs exposing API keys, and an automated Havage SQL injection demo that pulls database name and rows from a live site. Demonstrates intercepting mobile API calls with Fiddler, extracting lounge Wi‑Fi passwords, and a $100 Wi‑Fi pineapple that captures probe requests. Cracks 30 salted SHA1 hashes with Hashcat in ~39 seconds (6,272 kH/s) to argue for slow password hashing.
AI-written summary · about
chapters (24)
- 0:00Start
- 1:27How To Get a Credit Card
- 7:44Sequel Injection
- 11:39Error Based Sequel Injection Attack
- 17:46Security and Mobile Devices
- 19:53Turn Off Certificate Validation
- 23:06British Airways
- 25:51What a Man-in-the-Middle Attack
- 26:43Man-in-the-Middle Attack
- 28:53Transport Layer Protection
- 29:34Logging In with Credentials
- 32:18Fiddler's on before Response Event
- 35:51Wi-Fi Pineapple
- 37:26Probe Requests
- 40:56Using a Hash for Password Storage
- 41:52Plaintext Storage
- 42:11Problem with Hashing
- 42:41Rainbow Tables
- 44:59Salted Hashes
- 45:32Password Dictionary
- 52:03Control Your Toilet via Your Phone
- 53:45Static Analysis Tools
- 54:40Is There Anything Coming Forward in the Future To Kind Of Regulate Bigger Companies Dealing with a Lot of Data
- 58:00Kickoffs Principal
