I Break Your Prod Live with 15 Security Flaws

on YouTube ↗40m

" summary

A live-demo shows compromising a production-like web app by chaining about 15 vulnerabilities to achieve account takeover, admin actions, and data exfiltration. Vulnerabilities demonstrated include SQL injection, CSRF, stored XSS, IDOR/object-level authorization, mass assignment, predictable RNG, JWT forging via weak HMAC (MD5), SSRF, and exposed error information, using tools like a request replayer, injected JavaScript, cookie/JWT manipulation, and predictable-token math.

AI-written summary · about

" chapters (25)

1. 0:00Introduction
2. 2:07App security flaws
3. 4:46Sensitive data enumeration
4. 6:11Live SQL injection
5. 7:35Fraudulent account validation
6. 9:15CSRF
7. 11:33Unauthorized data access
8. 13:59Score abuse
9. 15:07Client-side only validation
10. 15:51Sensitive cookie manipulation
11. 17:31XSS
12. 18:13Unsafe deserialization
13. 20:59Malicious code execution
14. 22:26Predictable codes
15. 24:32Exposed exceptions
16. 26:26Weak random generators
17. 27:31Vulnerable dependencies
18. 29:00Unsecured workflow
19. 30:48JWT token forgery
20. 32:30Unrestricted admin access
21. 33:37Insufficient page protection
22. 35:03SSRF
23. 36:28Logging and analysis
24. 37:11OWASP Top Ten
25. 38:15Security culture

" related talks

• 45mI abuse your production live with 15 security flawsGaëtan Eleouet · BDX I/O 2024
• 44mI hack your production live with 15 security flawsGaëtan Eleouet · Voxxed Days Luxembourg 2023
• 47mLive Hacking: Breaking into Your Web AppBrian Vermeer · Heapcon 2019
• 41mLive Hacking: Breaking into Your Web AppBrian Vermeer · GOTO Amsterdam 2022
• 46mLive hacking: Breaking into your Java web appBrian Vermeer · Devoxx Belgium 2019
• 42mModern web application bugsErlend Oftedal · NDC Sydney 2018
• 22mIntegrating Security Measures Throughout DevelopmentFrancesco Vecchi · Conf42 DevSecOps 2022
• 01h 02mLive Hacking: Breaking into your Web AppBrian Vermeer · Developers Summit 2021