Revenge of the Geeks: Hacking Fantasy Sports Sites

on YouTube ↗46m

" summary

Shows how mobile fantasy apps actually break: stole session tokens at draft using a Wifi Pineapple and Burp proxy, then changes opponents’ lineups and posts comments; details payloads against JSON/REST/AMF, failures like no SSL, no nonces, infinite session lifetime, and replayability. Demos include Words With Friends word-bypass and Bump contact hijack, explains concrete fixes (nonce, timestamps, request signing) and provides slide/whitepaper setup to reproduce the attacks.

AI-written summary · about

" chapters (10)

1. 0:00Intro
2. 2:01Hacking Mobile Apps: WiFi Pineapple
3. 8:26Hacking AMF: Raw traffic AMF is a binary format
4. 14:12Trusting the client
5. 16:05Allowing lifetime sessions
6. 19:43No curfew for requests
7. 23:05Avoiding the 7 Deadly Sins
8. 23:36Hacking Mobile Apps: Fantasy Football
9. 34:30WiFi Pineapple Giveaway!!
10. 37:43Hacking Mobile Apps: The ideal setup

" related talks

• 41m7 Deadly Sins: Unlock the Gates of Mobile Hacking HeavenDan Kuykendall · AppSec California 2014
• 36mI just hacked your app!Marcos Placona · GDG DevFest Ukraine 2017
• 46mThe Art of Cyber Espionage: Unleashing the Power of SCADA and ICS HackingMuhammad Shahmeer · DevDays Europe 2024
• 07mI just hacked your app!Marcos Placona · Voxxed Days Zurich 2017
• 45mI just hacked your app!Marcos Placona · Voxxed Days Zurich 2017
• 44mI just hacked your app!Marcos Placona · Mobile Era 2017
• 59mHack Yourself FirstTroy Hunt · Web Directions South 2013
• 59mMaking Hacking Childs PlayTroy Hunt · NDC Sydney 2016