Death Star Security: A Realtime Look At How A Site Is Hacked
summary
A demo site at DeathStarSecurity.com shows two concrete failures: a droid-scanner search module that calls an external API and literally sleep()s on every result, causing easy form-targeted DDoS; and a customer-tracking module that echoes query-string tokens into the page using Twig raw, enabling persistent XSS that can steal cookies or keylog. Fixes shown: move slow work to queues/cron or async workers, use Drupal Form API to validate inputs, never use Twig raw, and run a code sniffer in VS Code to catch unsanitized output before deployment.
AI-written summary · about
chapters (6)
- 0:00Start
- 2:44Security Architect - Empire
- 3:49DDOS Distributed Denial of Service
- 5:12Move slow functions to asynchronous queues
- 7:57Inherent trust in user input is DANGEROUS!
- 10:22Can exfiltrate data on the screen or capture cookies
related talks
01h 01mSomething Something Cyber
41mLive Hacking: Breaking into Your Web App
47mLive Hacking: Breaking into Your Web App
52mHow to get properly hacked!
20mChaos Engineering on the Death Star
33mHacking The Front-End
32mWeb Security for Newcomers: how to avoid getting hacked as a software developer
01h 10mHack to the Future