How The Hack?
summary
Starts with a $9,000 first payout and explains how bug bounties scale to six-figure rewards while showing concrete exploits: sequential order ID leakage that exposes ~600,000 customers’ PII by incrementing an order number; admin via user ID swap and role injection that turns a regular account into an admin; exposed admin panels via robots.txt and widespread GitHub leaked keys (searches return ~32.5k FTP/password hits and ~414k leaked API keys); demos use Burp Suite, GitHub search and basic scripting; fixes and impact are shown for each case.
AI-written summary · about
chapters (17)
- 0:00Intro
- 1:05Agenda
- 1:30Who am I?
- 3:38How did I get here?
- 8:55Bug bounty
- 11:15Hacking
- 15:00Examples
- 15:33From receipts to riches
- 18:29I too, can bean admin
- 21:22Not so complicated
- 21:55Dissecting Robots.txt for admin panel access
- 23:26Default credentials, millions at risk
- 25:34GitHub's hidden treasure
- 28:44What does it take?
- 32:53Where can I learn?
- 38:11What else?
- 42:10Outro
related talks
29mThe Smörgåsbord of web app hacking
38mHackers Gonna Hack: Identifying and Fixing Vulnerabilities Proactively
01h 01mHow hacking works - Web edition
41mWhat the Hack: A Personal Story about Ethical Hacking
30mHow to hack a web app?
53mOpening Keynote – Dr. Katie Paxton-Fear
39mHow to think like a hacker
42mHidden Chains: Revealing High-Impact Bugs from Bounty submissions