How We Hacked LinkedIn & What Happened Next

on YouTube ↗27m

" summary

Shows concrete XSS variants that steal real passwords from LinkedIn, Indiegogo and eBay by abusing allowed attributes and styles to spawn full‑page overlays, capture form posts and return users to the site; uses BeEF as a command‑and‑control payload, CSS class/id whitelisting to bypass style restrictions, and an IE password autocomplete trick to harvest plaintext credentials; demos iframe and image‑overlay attacks that succeed despite WAFs because no JavaScript executes, and recommends tightening whitelist rules, disallowing iframe embedding and using HTML5 sandboxing.

AI-written summary · about

" chapters (7)

1. 0:00Start
2. 1:39Indiegogo Demo
3. 3:30Cross-Site Scripting
4. 10:51Ebay Demo
5. 11:13Iframe
6. 15:43Linkedin
7. 25:35Connected Graph Visualization

" related talks

• 30mThink Like a HackerStephen Rees-Carter · Laracon EU Online 2021
• 33mHacking The Front-EndAlex Sexton · Full Stack Fest 2015
• 01h 01mHow hacking works - Web editionEspen Sande-Larsen · NDC Oslo 2023
• 21mEverything We're Doing with Passwords is WrongHoyt Kesterson · RSA Conference Asia Pacific 2013
• 34mJS Security - A Pentesters PerspectivePrasanna Kanagasabei · JSConf.Asia 2015
• 40mXXSS: Exotic Cross-Site Scripting vectorsBenedek Gagyi · Øredev 2019
• 01h 02meXential XSS (Cross Site Scripting)Alex Mackey · NDC Melbourne 2022
• 35mInside a hacker’s mindMaria Shoaib · Øredev 2019